Asking bank username and password is illegal. But they can ask you to type username and password from bank web form which should be fine. I always use 2FA authentication for peace of mind