Thanks for taking the time to explain this: it does indeed seem clear that they are just doing username and password detection for access. A followup question:

Thanks for taking the time to explain this: it does indeed seem clear that they are just doing username and password detection for access. A followup question: I have lived in Europe and have accounts in banks in Ireland. For those accounts, actually executing any financial transaction requires entering a one time token generated by a device that uses your debit card and PIN. Like so: https://www.youtube.com/watch?v=kEOEQzC8-Fc https://www.youtube.com/watch?v=kEOEQzC8-Fc Do the banks you tested have a similar setup? Just trying to find out if these specific banks have chosen to control view transactions with just the username / password but require some other additional authentication for actual financial transactions.