Then they send you emails (from some random non-official looking domain) with password protected PDFs and ask you use bits of your account details to open it. The opportunity for phishing is insane.