An additional problem with the implementation is that it requires javascript. I was working on a project for a UK bank - their security guidelines required securecode, but their accessibility guidelines required that the site work without JS. Sadly achieving the two is impossible.

I agree this is an awful user experience, at a time where the trend in payments is to make the user's experience better this is a huge step back.