What's depressing is that bank and mutual fund websites don't generally have OAUTH or 2FA and they're the ones with the worst consequences they get hijacked.