And their solution is: if you get the password wrong 3 times in a row you have to call them to unlock your account. I learned this the hard way, unfortunately.

Reminds me of my bank as well, which also makes using a password manager awkward and raises questions able how they are storing the passwords: "Enter character numbers m, n, o from your password".

My bank has a fixed 8 digit number as the password, and mandatory SMS 2FA (which is flawed).

They also offer hw token login but you need to buy them and I don't think a relevant percentage of users uses those.

AFAIK it's also only numbers...

That card must have good rewards if you're sticking with a site like that.