I vaguely remember hearing this line of reasoning behind Banks and their password complexity restrictions: "Users are more likely to forget complex passwords t

I vaguely remember hearing this line of reasoning behind Banks and their password complexity restrictions: "Users are more likely to forget complex passwords than simple ones. So in order to save resources on providing support to users of lost passwords, we force them to make their passwords relatively simple, and we can afford to do that because we have other more advanced mechanisms in place to secure accounts (secret questions, IP restrictions, log-in pattern heuristics, etc)" Not that I agree with it. I still see no reason why they couldn't leave the choice of password complexity to the user. A complex password in addition to their "advanced" security mechanisms is always going to be more secure than a simple password in combination with these same mechanisms. I suppose the real reason is probably something to do with not wanting to upgrade their "battle-tested" legacy systems that simply don't support complex passwords. Which I can sympathize with due to the risks involved in performing such upgrades. Still, I imagine sooner or later their hands will be forced by a high profile data breach of some kind at a big-name bank that exploits the limited protection these simple passwords can provide.