If you want an absolutely egregious example of how bad this can get here is an article I wrote a few months ago about the security practices of an American Credit Union.

https://metafarce.com/lafayette-federal-credit-union.html