From what I've seen, they usually ask for your username (or account ID) and password, then three characters from a second passphrase. This helps prevent a vast majority of non-targeted keyloggers and form-grabbers, as capturing one login will likely not get you enough information to log in a second time.
In terms of the security, there are a few ways this can work. The most secure common method is a Hardware Security Module (HSM), which is essentially a black-box device that allows limited operations to be performed on data within it, with both software and hardware security measures. The idea is that you can tell the HSM to set the user's passphrase, or verify three characters of it, but you can't ask it to tell you the whole passphrase.
Another option is to encrypt the passwords in a database which is accessible via an internal web service that emulates the write/verify functionality of the HSM. It's less secure, but has improved cost options, and can be more flexible if the bank has an internal development team.