Don't the banks raise red flags when IP addresses outside the norm try and log in? Scary for anyone to hand over their login data considering they have no idea who gets access to that. Sometimes it may be individuals not even in the country. Not a good practice to force this.