I don't know where you are, but in the US it is actually illegal for a bank to offer financial services without collecting a significant amount of personal data from the customer. This exists for a few reasons but I think the most significant one is that the government does not want to give up the ability to block financial transactions for those they deem unacceptable. (Like terrorists.)
It all makes sense, they are required to know me for AML reasons, so the account creation step collects this data.
The bank is mobile first, so the account is activated through the app when my card arrives. Why would I have a username and password for the app that is used to create the account in first place? The app can keep it for me without exposing it to me ever. I can’t be phished for something that I don’t know and it is one less password to remember or take care.
> Please don't post comments saying that HN is turning into Reddit. It's a semi-noob illusion, as old as the hills.
You then have to record a video selfie saying something like "I am NAME and I want to recover my account" and then send a pic of an ID. Same process (the selfie+ID part) for if you want to display your card PIN reminder.