It would theoretically use whatever meachnism you would use to interactively log into your bank. For Canadian banks this is user, password, and security questio

It would theoretically use whatever meachnism you would use to interactively log into your bank. For Canadian banks this is user, password, and security question/answers. The "plugin" system was designed to account for each banking system being unique so how it logs in really depends on the bank. This runs locally and it has the ability to read gpg-encrypted credentials (using gpg-agent). This of course gets complicated with TOTP tokens but I'll cross that bridge when needed :)