This question is inspired by an experience I had today with online banking, as follows. One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a constituent of the Dow -- in other words, not a fly-by-night institution.) Earlier this month, they launched a redesigned web interface, and today was the first time I accessed my account since the redesign. I accidentally used the same password I used when I originally created the account. However, I had previously changed my password. The old password should not have worked, but it did!
Subsequently it became apparent they had associated my account with old information: They asked to send an activation code to a phone number I have long since abandoned, but which I used when opening the account. After opening the account, I had replaced the old phone number with a new one in addition to changing the password. So it would appear the bank reverted to my outdated personal information (ie, password and phone number).
People sometimes change their password because they believe their old password may have been compromised. But this countermeasure is ineffective if the institution will still accept an old password.
Is there any reason to believe a reputable bank would intentionally accept an old password?