The security of my bank is pretty good, any account management action (password reset, card pin change, mailing address, email, name, etc.) requires physical presence in the closest branch. Not any arbitrary branch, the closest. With my passport. Not some bill or mail on my address. My passport.

The password reset will then setup a new password with 12 characters, number and specials included. This password is then sent via german postal service to my house, I can't pick it up on my local branch or have it told to me. Send via mail. Period.

The letter advices me to change the password to something secure immediately and destroy the letter securely afterwards. The banking website enforces this and you cannot change your password to any temporary password that your account previously had. (So if someone intercepted the letter, you would either notice or it would be useless)

The only downside is they have an ancient COBOL mainframe doing the accounts, so they're case insensitive and encoded in ECBDIC, although they are properly hashed using bcrypt, there is an upper limit of 24 characters because it still passes through there.

So I would say my bank is banking on the customer picking a good enough password and hoping they can replace the COBOL mainframe at some point.