All you really need is a few bits of personal info and a poor password at your bank and it can happen.
One of the reasons why most companies are going to “passkey” is for exactly this reason.
I use a passkey PLUS add two-factor authentication to access any financial account.
4 months back a hacked card was to be replaced and it was overnighted. I never received and called when home from vacation. While on the phone with them the woman commented, “Oh, my gosh, that card just got authorized.” I found the envelope in the yard a few weeks later when the snow melted. It was untouched. I called and told them the problem was within their company.