Which is why many banks (or at least the respectable ones ^-^) don't rely solely on username/pw combination. As pointed out above, German banks generally use OTPs (One-Time Pin), which they send you by mail in a non-see-through sealed envelope. That means one needs to use a new OTP for every transaction (even messages sent to the bank by this system). I've also seen card readers used for those users that want the extra convenience and security.
I also have a bank account in Singapore now, and the bank I am using also went the extra mile: the login is Java-based (so the browser will have very limited, if any, access to information entered), and the PIN is not typed but entered using an onscreen keypad where the position of the numbers change every time. Additionally, I can only make a transaction, or see account details, after I correctly enter a 6-digit number sent to my mobile phone.
On the other hand, for a lot of pages I couldn't care less if sb knew my password, e.g. some online radio which stores my music preferences. Which is why I use an unsafe and easy-to-remember pw for those. Or those websites that give you an account for the sake of giving you one - I remember specifically one site which allowed me to send 3 free sms per day to any operator...