I have had an account with a Bank in which my online accounts password was just a simple 8 character all lowercase password with two numbers. By today's standard it would probably take a single computer less than an hour to brute force the account. This bank does not do dual factor or MFA. I was wondering if they are possibly employing another method whereby extra steps are taken to protect my account with such a weak password? If so what are they doing? If nothing I suppose I my account is a ticking timebomb until I update my password and its a crap shoot?
Firstly, you will only get a few attempts to try to log in before the login is locked and you have to phone up to get it re-enabled.
Secondly, though you used only lower case and numbers, that doesn't mean that you couldn't have used more.
Thirdly, they use monitoring programmes that detect unusual activity and block it until it can be verified.
Finally, some level of loss is expected and built into the costs of doing business.
Of course, that doesn't mean to say that you should leave such a weak password in place - you absolutely shouldn't - getting a compromised account sorted could still cost you a lot in time as well as money.
Nor should you do business with a bank that allows such weak practices. Any decent bank would at least have a secondary factor such as forcing you to enter n out of n+++ characters from a secondary passcode. Or maybe an answer to one or more security questions.