In the US, you pay businesses by sharing your account number(s) with them. They initiate pulls from their infrastructure, which your bank responds to without co

In the US, you pay businesses by sharing your account number(s) with them. They initiate pulls from their infrastructure, which your bank responds to without consulting you. (You may call them after the fact if you disagree). Your account number is a "secret" shared among potentially hundreds of merchants and all it takes is one of them to leak it. Online banking webapps are mostly a read-only view of your transaction history. Sometimes they are capable of pushing money out, but for a new payee this generally requires phone verification, and in all cases it sends a lot of emails and takes a few days. But even just by virtue of having a password (which you have not shared with every store you've ever visited) it's already much harder to attack online banking than it is to make fraudulent credit card or ACH transactions.