It is unlikely that Holmes could of gotten into Chris Jacoby's online banking account so quickly by guessing his password. We saw him enter at least three incorrect passwords, he could of had more unsuccessful attempts that were not seen. All banks have security features in place on their websites to prevent the very thing Sherlock is attempting. If someone enters an incorrect password several times, the industry standard is three, the account is locked out for a minimum of 24 hours.