Most banks consider a password to be a form of security theater (and quite rightfully so). Banks monitor many other aspects of the login (e.g., IP address, date

Most banks consider a password to be a form of security theater (and quite rightfully so). Banks monitor many other aspects of the login (e.g., IP address, date/time, computer, what you do when you log in, etc.). Even if someone knows your password they will not necessarily be able to conduct a transaction on your behalf. Case sensitivity only adds an extra bit of entropy (possibly even less since I suspect the average user employs lower-case characters more frequently).