If you are making up random usernames on a banking site, attackers aren’t going to know your username. So it is two-step.
The username isn't supposed to be a secret, social engineering will most likely be very easy.
The username isn't supposed to be a secret, social engineering will most likely be very easy.