In theory nothing bad happens as the person with the snail mail code list still needs your login/password to issue money transfers.

But then again ... you just handed your banking credentials to some shady fintech startup.