HSBC uses a combination of a username, password, and security key.
In this implementation, you first enter your username.
Next, you are prompted to enter your password and three random characters from your security key:

download bmml source – Wireframes created with Balsamiq Mockups
The benefit of this approach is that the password does not need to be stored in an insecure state. The interface also does not tell an unauthorized person the length of the security key.
By including disabled text boxes in the interface for the chars not requested, the user can more easily "spell out" their word and provide the correct letter without having to internally visualize the key's individual chars.
The implementation in the question has a much higher cognitive load because the user has to visualize the word and then count places to get the character.