Is your question "how exactly would the site usage monitoring hacker steal your bank account?" or "how would a bank use two-factor authentication over the inter

Is your question "how exactly would the site usage monitoring hacker steal your bank account?" or "how would a bank use two-factor authentication over the internet?" For the former, if we assume a malicious website administrator collecting usage details, he'll use the email address and other information revealed during the sign-up to spear-phish the unwary user with malware targeted at their particular bank. Such malware is available at any wretched hive of scum and villainy at reasonable prices. If your question's the latter, solutions include a battery-powered token that produces different numbers at 60 second intervals, a temporary PIN sent by SMS to a registered phone, and others.