Banks keep all sorts of metrics on customers, to approve or deny transactions. If someone types their password into bank .ru/phishy.php and never changes their

Banks keep all sorts of metrics on customers, to approve or deny transactions. If someone types their password into bank .ru/phishy.php and never changes their password afterward, that's useful information. If they then try to buy $10,000 of bitcoin in coinbase, the bank algorithm should probably deny it or require more verification steps. I'm not saying this practice is good, but I get it. Also, banks share the same technology like chexsystems, who could use A/B testing for research. It's cheaper than focus groups. For example, if A/B tests show requiring customers to submit their username first, then on the next page it says "Hi Bill! Great day in San Francisco! Enter your password: " causes them to notice the url bar isnt chase.com, thats good tangible info that will save banks from losing customer money.