I know a local bank that limits password lengths to exactly 7, and the contents of the passwords to ONLY DIGITS. I can't imagine how many users are going to just use their phone number.