This is still a ton better than asking the client for credentials and then scraping their logged in bank accounts which is hella creepy.