Yeah, ING Direct's password scheme is pretty lame. I assume the idea was to use a simple numbers-only on-screen keyboard to avoid keyloggers. Seems silly, since if malware were to target them it would obviously just track clicks instead.
Though to be fair, they ask additional security questions if you haven't previously logged in from that browser.
<megarant>Their model sucks. First I have to now remember (can be read as write down) a separate account number, a bunch of digits. Second I have to now create a PIN and I can't even use a keyboard to type it in.
Account creation at ING is also awful. I created my account, but did not yet "activate" it. Keep in mind that it did not tell me in any obvious way that I needed to take extra steps to activate the account. Once I tried to log in it started asking me questions like "What is your father's father's name?" and my answer was: you cannot possibly know that yet since I haven't told you. Eventually I figured that out.
Next comes the verification of my checking account. This was fun because I have a joint checking account and a joint ING account. Guess what: it made me AND my wife verify the same exact transactions. Seriously? It's just bad UX all around. Now that I've got it set up I am fine with using it, just the initial process was awful.</megarant>
Though to be fair, they ask additional security questions if you haven't previously logged in from that browser.