I have an Android phone, but I would never use it (or an iPhone for that matter) to log into my bank account.
Sorry, legitimate Android app developers! I would like to pay you for the things you create, but your neighborhood is too sketchy for me to visit.
Using a smartphone for banking is really dangerous because banks often use a phone as a second factor and compromising the phone gives full access to your bank account. And many phones do not get security updates.
Even with a regular bank account in most of the world at least, it's tightly regulated and you're only liable for a small portion of the loss - on a credit card, generally nothing at all.
Even without OS security updates, generally browsers and other internet connected software gets security updates regularly, I'd trust a new user on Android far more than Windows because clicking an ad would not have a risk of getting them infected system wide without jumping through some serious hoops and involving a few exploits. On Windows that's one Run button press away.
I would argue it the other way round. On mobile (Android or iOS), apps have much fewer permissions compared to on desktop. e.g., one app can't look into the data of the other app. On desktop, it is possible to write a binary which steals user cookies (e.g., https://github.com/rash2kool/cookie_stealer). For all purposes, the binary would be legitimate, and no antivirus or OS APIs would mark the binary as bad.
However, on mobile, one app can't peek into the private data of the other app. So, the Uber app can't peek into my browser cookies.
- banks often use phone (for example, SMS) as a second factor for authentication, for example to confirm transactions. Compromising a phone thereforer provides full access to your account. Some banks even allow to perform payments by sending SMS without logging in.
- many phones do not receive security updates in time. And those updates close only public vulnerabilities.
- while Android has good permission system, many apps have a very wide set of permissions, including permission to read or send SMS messages, or permission to use accessibility functions, so compromising such an app can also be enough.