My bank limits passwords to at most 5 alphanumerical characters. Yup. Five. There are over ten times more possible customer IDs (10 digits) than passwords.
Until someone gets ahold of a list of the hashed passwords and can brute force them at home without triggering the lockout.