"with one (UK-government-owned) bank, two wrong password attempts simply lead to an invitation to set a new password."

Good lord! Reading through this document is like reading a primer in how not to make a secure form.