I think basically everyone in this thread is looking at this all wrong. Banks don't have a ton of fancy hidden security gating the login itself most of the time. Trying to build a digital Ft. Knox in front of the login page and then paying no attention to what the users do after they login is the wrong way to go about securing these types of accounts.

I'm pretty sure they have much more security around detecting and blocking suspicious behaviors after you've logged in, like adding new payees on bill pay systems, requesting transfers of large amounts of money to random accounts, particularly overseas, etc.

I also argue that banks have much, much better security than anything most of us have ever touched, because they handle billions of dollars moving around routinely and manage not to lose it. Meanwhile, half of the internet can't manage not to lose the email addresses of everyone who signed up for their cat picture website. If they're trying that hard to steal something of little value like that, how hard to you think people are trying to steal the billions of dollars that banks handle?