If you do that, the bank will notice a bunch of connections from the same IP for different usernames. You could use a botnet to do the lookups, but that still

If you do that, the bank will notice a bunch of connections from the same IP for different usernames. You could use a botnet to do the lookups, but that still makes the attack substantially more difficult.