Here’s their potential path, maybe ….

I have no idea the limitations of this approach, if any, but just experienced it a few days ago. I bought something expensive online, and the timing was sensitive, else I’d lose out on a lot of money. Then I got down to the final payment. It made me really nervous and would have reconsidered if I knew about it, but the final payment could only be done through bank transfer, but they wouldn’t let me provide the standard routing and account numbers. They had a web app that brings up your banking app, has you login to that, and appears to scrape data. They were able to see my accounts and balances, as well as initiate the transfer. This was so scary, exactly like I’d expect malware to be.

Bviously I changed my passwords immediately and verified there was only one transaction and exactly as I’d expect. However yes, they controlled my bank8ng without being a bank and without any apparent cooperation from my bank. All it takes is normalizing the behavior that will get us all robbed of all we own