They just have to claim it's test data. If they didn't, this could blow up really bad - the regular user would be convinced that the bank messed up. In this scenario, it can be played off as a "test to improve security" (or whatever), if it ever were to end up in the mainstream media.