My bank did that with a JavaScript number pad. They went back to a standard password field with the new design of the site a couple of years ago. That made me feel less safe because I understood why the were complicating the input.
Another strategy I've seen is to ask some random digits of a longer PIN, with a mask to fill out.
Some banks (e.g. Barclays) use a card reader that generates a unique key each time. Since this also requires that you have your card to log in, it's my understanding that this offers massively improved security.
Another strategy I've seen is to ask some random digits of a longer PIN, with a mask to fill out.