The Sparkassen in Germany do this, but they're not alone in doing so. They lock you out after a couple of attempts, so brute-force is out, but it's still dumb.
Until someone gets ahold of a list of the hashed passwords and can brute force them at home without triggering the lockout.