User-facing security is just the tip of the iceberg for bank security, and IMO one of the less important factors. You have regulations like CPI on how to store

User-facing security is just the tip of the iceberg for bank security, and IMO one of the less important factors. You have regulations like CPI on how to store credit card credentials, transaction history, and audit logging. You have regulations on physical access and who's allowes to touch production. There's enormous amounts of regulation on auditing and software that's permitted to generate bank transactions. Having worked in the space I am definitely impressed; it's taken very seriously, there are real, concrete consequences for not taking is seriously, and you generally don't see retail banks failing because someone messed around with ACH transactions, for example.