I've had this before as well; Very annoying.

Banks are world class leaders in technical inertia. Almost certainly at some point when they're designing their system they've got a interface from the 1970s or maybe even the 1980s if it's a new bank, that has to work with everything else which has the limited input fields. And that just propagates to all the other systems in these weird ways

Oh yeah we're using a file system that integrates over LDAT but it only looks at the first eight characters cuz the rest are used for the domain etc etc etc

Banks are still doing SMS-based 2FA. And after doing some security training at work written by the FBI and seeing it suggest switching letters/numbers around to make a password “more secure” (like th15); I’ve completely lost confidence in banks’ security standards.