One other red flag: your bank asking you for your username. At least for me, my bank would never use anything other than my real name.