I'm collecting bad password policies from places that should know better; this time from Xero, the default password to access payslips is the user's initials in upper case followed by their date of birth.
Not like a friend/colleague knows that information or anything.