Presuming that is the actual login page:
Yes, this is very insecure by modern standards, and even more so for anything involving actual monetary transactions.
There is always the slim possibility that the page loads on HTTP but then submits to a server protected by HTTPS. That would still be bad but would at least be "better". However, I confirmed that this doesn't happen. As I'm sure you know this would allow anyone on your local network (or anywhere between you and their server) to read your username and password.
There is also no CSRF protection on the login endpoint - this can introduce a lot of other more subtle security weaknesses (although not anywhere near as severe as failing to encrypt your login credentials).
The best-case scenario here is that the page you are on isn't supposed to be the primary login page, but you ended up there by accident and they forgot to remove it and direct people to the login page which is actually secure.
I ran the website describing their security through google translate. Obviously it won't be perfect, but it certainly gives the highlights:
- We've never had a breach before - nothing to worry about!
- We have a super secure firewall
- We use SSL encryption!
- You can change your password!
- You can deny access to your account from all but one device
- You can see when/where you last logged in
- You can get a text message everytime someone logs in
- Even if someone were to login your money would be safe because we don't allow transfers to any accounts not specified by you and indicated in your contract
I wouldn't take any of that very seriously, especially in light of their inability to provide SSL encryption on the login page, which is probably the most important page of all to secure. Given their lax practices here I would assume that they have security holes elsewhere in their system. Whether or not they have ever had a breach is something no one will ever know - what should say is:
If we've ever had a breach we at least don't know about it! We promise we're not lying!
If they really haven't ever had a breach it is probably because no one has ever bothered trying to target them, and not because of good security practices. I wouldn't even take point #8 seriously. You'd be surprised what people talk account support technicians into doing, and even if an attacker can't actively steal your money, this doesn't mean that they can't cause you severe harm if they get into your account.