Thanks for taking the time to explain this: it does indeed seem clear that they are just doing username and password detection for access.

A followup question: I have lived in Europe and have accounts in banks in Ireland. For those accounts, actually executing any financial transaction requires entering a one time token generated by a device that uses your debit card and PIN.

Like so:

https://www.youtube.com/watch?v=kEOEQzC8-Fc

Do the banks you tested have a similar setup?

Just trying to find out if these specific banks have chosen to control view transactions with just the username / password but require some other additional authentication for actual financial transactions.