I think it's just the banks 'she'll be right' attitude.

ING still uses a client code, which is written on your card plus a 4+ digit pin code on both Web and app to login.

It will take one decent breech for them to wake up..