Banks are learning what happens when an agent's only identity is the customer's password: no one, not the bank or the logs, can tell it from the person.
Agents need their own identity you can scope, revoke, and read back. Read-only just delays the problem.
https://t.co/frOr7m7BEA
Good reminder from the eMudhra mess: your browser trusts a whole list of certificate authorities, and whatever any of them signs, you trust too. This one got caught with keys weak enough to guess, one was literally 4. Browsers caught it fast. Almost nobody looks at that list, though.