Strictly less harmful. At the two banks I've dealt with, the worst someone with login credentials would be able to do is view my transactions and move money bet

Strictly less harmful. At the two banks I've dealt with, the worst someone with login credentials would be able to do is view my transactions and move money between the accounts I already hold. Initiating any kind of transfer out requires knowing the entire account number, which the web interfaces hides, and would send me email warnings besides. Meanwhile, the account number alone is good enough to initiate a wire or EFT with no prior notice.