Yep. This is kinda useful as an indicator whether you wrote login correctly (wrong pic = wrong login) and to weed out the lowest quality phishing, but for anyon

Yep. This is kinda useful as an indicator whether you wrote login correctly (wrong pic = wrong login) and to weed out the lowest quality phishing, but for anyone who's not a clown it should be easy to recreate the flow and hence, it's actually even harmful (you think you get assurance you're not scammed while getting scammed). Edit: one thing to make it more bulletproof would be bank rejecting all calls that look like serverish initiated (AWS etc), then the attacker would need some genuinely looking botnet to not get blocked by the bank due to suspicious volume from same IP pool. Raises the bar for attack, but still, serious attacker can mitigate this.