My bank upgraded from a 4-digit pin code authentication to a 6-letter ([a-zA-Z0-9]{4,6}) system. About legacy databases ...
Naturally, I complained and they told me it wasn't that big of a deal, because the actual transactions were protected by TAN generators. I had no answer to that.
Maybe I'm confused, but are they saying that you do use independent 2-factor authentication? If so, then that does reduce the risks associated with a weak password, even if it would be better to use a strong password in combination.
Sorry for being unclear. For the actual transactions, there is a TAN required, but for sniffing around your transactions, seeing all your bank account information and so on, all you need to log in as the 6-letter password.
Naturally, I complained and they told me it wasn't that big of a deal, because the actual transactions were protected by TAN generators. I had no answer to that.