I could swear learning somewhere that it's because forcing short/simple passwords makes it harder to recognize the password in keystroke logs, which is the attack vector banks face the most. Can't find any sources to back that up, though... has anyone else head this explanation?
I'd expect that the attack vector banks face most is that oblivious users simply give away passwords through phishing schemes. And banks with reasonable security don't rely on passwords (alone), but on some kind of token generator, in which case such a phishing scheme which directly transfers money to the attacker is the only option (any keystrokes captured are useless after x minutes).
