Truly ancient Cobol running in the back is my only guess. Why they wouldn’t have their authentication systems completely separate with better security features and some sort of token based access to the backend is beyond my understanding of their back end.