It's even worse than the HTML scraping. Banks will do literally anything if the instructions arrive by fax or mail, assuming you get the account number correct. The practical security of banking is ridiculously bad.