Or you could just send them a real letter (I think an institution like a bank would respond better to that than an email). I'd just tell them that I'm a concern

Or you could just send them a real letter (I think an institution like a bank would respond better to that than an email). I'd just tell them that I'm a concerned customer who stumbled upon the flaw. I would never threaten them to release it publicly though - I'd tell them that I'd forward the letter to the relevant government organisation. Where I am in Australia this would be something like the BFSO (Banking and Financial Services Ombudsman) and/or ACCC (Australian Consumer and Competition Commission).