HSBC asks for a primary password as well as 3 random characters of a secondary password. They could hash your original password + each of the characters in your secondary password, which would mean an attacker would have to crack your primary password first if the database was compromised.
From a UI perspective though it's pretty annoying having to enter 3 random characters of a (complex) password, although it's something you get used to.
From a UI perspective though it's pretty annoying having to enter 3 random characters of a (complex) password, although it's something you get used to.