What country is this? It doesn't sound like a banking sector with mature security practices. Major banks in developed markets should have tightened their customer workflows by now.