Unless I'm missing some technical trick, passwords are actually stored in plain text, not hashed at all. My reason for this assumption is that in some cases (I think it depends on card provider), instead of typing in the password, you just type in 3 specified characters from it (e.g. "please enter the 3rd, 5th and 6th characters"), certainly this is the case for my Visa debit cards from Barclays.

Is there any way they could verify a single character against a hash, or am I right in thinking it has to be stored plain text?

So many websites have annoyingly dumb password rules, just yesterday I was told that my "use this on a bunch of sites I don't really care about" password (which is long and contains upper/lower/numeric/special characters) couldn't be used because it had "recurring letters", i.e. the same letter was next to itself in one occasion. Therefore my password for that site is now "fuckingcunts", in my childish hope that some day that company will ask for my password over the phone.