Interconnected old mainframe systems fwiw... In the end, a lot of these banking systems are connected back to mainframe systems with a LOT of legacy cruft that

Interconnected old mainframe systems fwiw... In the end, a lot of these banking systems are connected back to mainframe systems with a LOT of legacy cruft that nobody has the nerve to actually update. It may not even be hashed or encrypted, which is part of why banks also add a second factor/cookie, though the implementation could/should be better.