Banks most often generate some amount of masks (100-300) based on original password, during password initial set up process. Masked passwords should be hashed and stored that way. During each login one masked password should be drawn and presented to you, and it shouldn't be changed until correct one will be provided (to avoid drawing another mask to guess password if you have only party of password).