Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros:
- they protect the password from naive keyloggers
- they prevent the user from storing the password in a file
But they do have cons:
- specialized keyloggers can still spy the passwords (see @schroeder's answer for a more in-depth explanation)
- then prevent usage of complex passwords (12 to 20 random characters) stored in a decent password manager like keepass
As far as I am concerned, I do not like them because of that. But I must admit that they may add some security for non-security-aware users. The problem with them is that as they require a rather weak password (at most 6 to 8 digits), the bank could be blamed in case of compromise.
With standard passwords, users can choose a strong password (and are advised to do so). So if they do not, they are fully responsible in case of compromise and cannot blame the bank.
