Such protection mechanism you're describing could possibly be exploited by the IE mouse tracking flaw, an Internet Explorer vulnerability that allows an attacker to track your mouse cursor anywhere on the screen, even if the browser is not being actively used, and to me seems such password protection would be more at risk of being compromised than your average run-of-the-mill solutions involving keyboard input, as it wouldn't even require of attackers to hack their way into end user's machine and install a key logger.
All it would take is for exploiters to hide an IE window (easy enough, say a pop-under would make most users unaware of it), or displaying third-party advert that's running a script recording mouse movements. Without wanting to give away too much information on how such exploits could be made to work (for obvious reasons), suffice it say mouse movement patterns can be matched against a use of a keypad like the one posted in your example, especially since the user is first required to click on a statically positioned access button and the keypad positions relative to the window (centered horizontally and vertically), through which the keypad's absolute position can be easily calculated.
Simply tracking mouse movement alone can as well, that's true for most users, tell you when a mouse button was clicked. But even without tracking mouse clicks, recording mouse movement alone can be enough to calculate if a user is indeed logging into a mentioned bank's account, and use subsequent mouse movement to calculate what his/her PIN was.
To cut things short, my 2 cents: I would advise against such mechanisms until ALL user agents (browsers) accessing it are considered secure enough in regard to it's function. ;)
It is still far from being a perfect solution and is not safe, not even by a long shot;
Keys are dynamically drawn through an external CGI application and identified by URI parameter string and a unique session key stored in a cookie, however they're accessible through this same URL address even when request fields change, e.g. have no referrer and are opened directly. They only appear to be sensitive to a session cookie value, and maybe user-agent string, but I haven't checked for the latter as -
It does not even matter:
So there we have it:
Dear Banque Postale, for the sake of your clients and your future existence, please stop with these lame attempts at reinventing the wheel and hire a proper IT security expert!