One possible attack is to change the details of a transaction before the page post it. To the user it would appear as she's transferring money to Bob, but it'd go to Eve.

My bank has two-factor using some special applet thingy on my phone (not a regular app, it's tied into the SIM card somehow). It shows me the details (amount and destination account) which I have to confirm using my password (in combination with a key from the SIM).

Much more difficult to circumvent, assuming the user pays attention...

Then, the malicious script can just pop up an official looking dialog box with a message saying that they are 'testing' the confirmation system, and please accept/agree to the next sms/alert from the app.

Having direct control of the user interface is very powerful.

Of course one has to have a minimum of awareness for any protection mechanism to work.

Eve should be among the known receivers though, which is a world of slow (~72hours to add an IBAN to my list for instance).

There are banks that try to make it faster though, with MFA, though the MFA system is usually SMS.

The banks I've used in Canada allow you to send transfers (uip to $3000) to other domestic bank accounts without reautenticating. Fortunately, they don't seem to use any third-party JavaScript.