(If your bank/financial institution is as stupid as mine – and apparently this stupidity is enforced by EU regulation – the best thing you can do is to use your password manager to generate a secure password for these. Use the readable words option as you might have to read it back to a human being at some point. If yours doesn’t accept special characters, you could try separating the words with numbers.)