In this particular case, yes, because banks tend to deny all liability for fraudulent transactions that result from credentials sharing, so the user is entirely

In this particular case, yes, because banks tend to deny all liability for fraudulent transactions that result from credentials sharing, so the user is entirely liable for whatever loss that occurs.