Is that even legal? What is the difference between this company and phishers collecting bank logins? And doesn't it look suspicious if the logins into differen

Is that even legal? What is the difference between this company and phishers collecting bank logins? And doesn't it look suspicious if the logins into different accounts are made from the same IP belonging to the online shop? Some banks in my country even require SMS verification if you are logging in from new IP address.