They are probably not doing anything illegal, sure you break the banks terms of service but you the user willingly gives the login credentials to the third party.