They just have to claim it's test data. If they didn't, this could blow up really bad - the regular user would be convinced that the bank messed up. In this sce

They just have to claim it's test data. If they didn't, this could blow up really bad - the regular user would be convinced that the bank messed up. In this scenario, it can be played off as a "test to improve security" (or whatever), if it ever were to end up in the mainstream media.