OK I’m pretty certain it’s the fingerprinting shield which is to blame. Toggling this on and off on the memorable info page alternately broke / fixed the page. Also I’ve disabled this shield ONLY on both domains and the thing seems to work okay. FYI the two domains used are:
https://www.halifax-online.co.uk/ -> username and password
https://secure.halifax-online.co.uk/ -> memorable information
Hope this helps