"So, I sent a detailed email to the bank's address"

I've found that a one-line response (i.e. no explaining why, no technical details, no explanations of explanations) generally works a lot better:

"Wouldn't this mean that everybody now has easy to guess passwords?"