The trouble is that most banks don't seem to explain that. At least two of my banking and CC sites explicitly ask for "mother's maiden name". Most people will just go along with that and won't even realise that they can make something up.

(The problem with passwords is that if they are obscure enough to be good security then they are also non-memorable, especially if you need a lot of them. So people then write them down...)