It is unlikely that Holmes could have gotten into Chris Jacoby's online banking account so quickly by guessing his password. He's seen entering at least three incorrect passwords, he could have had more unsuccessful attempts that were not seen. All banks have security features in place on their websites to prevent the very thing Sherlock is attempting. If someone enters an incorrect password several times, the industry standard is three, the account is locked out for a minimum of 24 hours.
Also even in 2014 most banks had multi-factor authentication that would fully prevent anyone without the access to one time passwords or other form of additional security measures from accessing the account.