At my previous bank, you could get your account password reset with SSN and birthday. Also, your account number (and your website login) was your social security number. And for the longest time, your password for your account online was your ATM pin. This is at a credit union in the US. I switched banks as soon as I had a significant amount of money in my account.

tbh, i'm surprised they don't have bank accounts emptied out regularly, but they're sort of small(limited to grocery store employees), so maybe its just nobody has seen it.