One of my credit card's bill paying site has an incredibly annoying limitation... it does not allow the user to paste in the bank routing and account number. Therefor, every month I am forced to manually type these numbers in (twice!). I have other credit cards and bills and none of them have this limitation. Is there any security advantage to the one bank not allowing pasting?
The problem isn't with pasting, it's with copying confidential data. The copy buffer isn't a protected resource and can be accessed fairly freely.
That said, account and routing numbers aren't really confidential as you give them out on every check so this idea sounds hair brained. Perhaps they do this to give the impression of security to less informed users? Perhaps they're just really confused.
Not allowing pasting can be for safety too. By forcing you to write them manually twice, you avoid the risk of incorrectly typing the numbers, which can result in money sent to the wrong bank account. Many users just copy the info from field 1 to field 2, to bypass the double-entry verification. In some cases, users do this from field 2 to field 1 if the field 2 had pasting disabled. That's why both fields have pasting disabled. It's for the same reason "paste" is disabled on the email/verify email, on signup forms.
So, it has actually nothing with security, but rather with safety. They don't want problems with customers mistyping account numbers, and then copy pasting them to avoid having Writing it twice, and then money lands at some bankrupt company and money is lost.
This sometimes happen here in Sweden. A bill-payer writes the wrong account number in their internet banking interface, and does not check the receiver name that pops up on "confirm payment". The company that receives the money is bankrupt and has debts, so the money is taken by the government to pay the company's debts. Thus "Conditio indebiti" is not enforceable, and then money is lost and the user in question has to pay a second time for the same bill.