Looking at their FAQ, mwave seem to have ceased this practice but they had a thriving online business at the time I wrote this:

https://lolware.net/2016/11/17/requesting_bank_login.html

Everybody single person who provided feedback on this blog argued I was "being pedantic about nothing", "throwing your fedora at them", and even at American Express they took very seriously the "get your money back" angle but seemed confused as to why I didn't want to hand passwords out.