Good points. I would still say yes, although it&#x27;s not a particularly huge problem. One scenario where it could be problematic is if the password database is stolen and nobody notices. They could then potentially brute force your numeric password and then access your account by phone.<p>In the universe of banking this is pretty small potatoes, though. My bank uses a case insensitive comparison for passwords (!), limits them to 8 characters (!!), and silently truncates anything over the limit (!!!!!!!!!!!!!!!!!!!!!!!!!!).<p>They say they&#x27;re fixing it. But it sure is taking a long time.