CapitalOne has the most secure password system (capitaloneonline.co.uk)

Ouch! This means that they are storing your original password in plaintext somewhere, and that is definitely NOT best practices!

Fidelity's phone system lets you authenticate by typing your password on the phone keypad. On the plus side, this is probably the only time I've understood the technical reason behind a limited password alphabet.

Why would anyone think this was a good idea?

In my experience, most UK banks do the same thing. Their excuse is that it prevents keylogger attacks. I do not know enough to say whether it's an acceptable trade-off or not.

I think it's important to call attention to these issues, but can we change the sarcastic title?

Is there another step after this one? Or does this get you in?

HSBC has this: single-letters from your "secret word", in addition to an actual full passphrase.

That is going to make lastpass hard to use for the site.

It also appends some garbage to the username, validates it and then proceeds with the random char grab....weird

  var results = document.cookie.match ( '(^|;) ?' +    "Username" + '=([^;]*)(;|$)' );

I remember awhile back I created a CapitalOne account and I put in a long password which it excepted, when I tried to login it wouldn't work, so I reset my password very carefully typing it. The password reset was successful, I tried to login and nope, didn't work. Third time reset I realised they have a max password length and were truncating my password as my original password was past their max length but would except, truncate without telling me and store it. This was the CapitalOne in the US.

Also, they don't support any kind of two-factor authentication, and have no plans to add that: https://twitter.com/AskCapitalOne/status/504679257239719938

Honestly don't all of the US banking and credit card companies do this sort of 'security theater'? While this seems pretty absurd, I'm not aware of any that don't have mediocore to poor password practices.