Bank of Montreal asks for the debit card number as the username but doesn't ask for the PIN. (And until recently they only issued interac cards that couldn't even be used online, So I guess the security risk was/is still low for the majority of customers)