The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some

The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some 2-factor rigamarole, after which point the bank redirects you back to the merchant. A more recent innovation is banks exposing this more directly to consumers. I can create a "payment request" in my banking app which generates an iDeal url which I can send by email/text/facebook/whatsapp/qr code/carrier pidgeon to someone who can then pay me. No exchange of account numbers required and the amount paid is deposited in your account within seconds. So yes, an oauth-like flow definitely is the way to go. It's more secure and more convenient, which is a pretty unusual combination.