This depends on the bank and the country, but web portals usually have some kind of 2FA on them. This means hacking into somebody's web portal account isn't enough, you still need to hack that mobile device first.