I closed my accounts with Chase and Citi because I kept getting locked out of my accounts for suspicious activity. Disabling PIA VPN helped but I never could figure out what else about me trying to avoid being tracked looked suspicious.

Apparently they take a 'only criminals would clear cookies' approach.

I use very aggressive privacy protections and have never been locked out of Chase or Citi. I've had a lot of trouble logging in though.

Maybe you're mistaking that for "only criminals would use a VPN [to disguise the true origin of their web requests]" approach.

Still not an absolute one should be unequivocally confident in, but risk management types for a major bank... probably don't care.

Then we simply decline to do business with them. Either they learn to care... or we don't care anyways, because they're no longer our problem.

I’ve always enabled fingerprint-blocking, first with extensions, now in the browser. The only places I had problems logging in are some very few online shops. Never a bank, and I had a bank with a password limit of 6 characters (about 5 years ago)

> I had a bank with a password limit of 6 characters

Clearly information security is their forte /s

Some of the bot detection products use fingerprinting to try to establish whether someone is a real browser or not

Use Canvas blocker which will give a fake fingerprint instead.