Absolutely wild to me that handing over banking username and password in plain text is standard process for mortgage broker platforms and anyone else you want to be able to process a bank statement. As usual my accounts for shitposting on the internet have 2 factors, passkeys and OAuth tokens up the wazoo, and the account that could ruin my life if compromised is protected by an SMS (sometimes) and a 4-digit access code that has a randomised keypad input.
