Apart from creepyness, it is absolutely amazing that the bank does that. I'm very impressed that a bank has such creative hacker minds to build a warning system like that.
If you work forwards from "wow, fonts are a weird fingerprint technique" it seems clever.
But the reality is it's much more straightforward if you just work it backwards. Someone said: we have access to the customer's browser, what can we grab to throw into our ML model? You look in the DOM spec, grab every piece of data you can get from the customer's system and send it all. Fonts is one thing that ended up being useful.
(I am not condoning this practice, just happen to be aware of it very well.)
Still on the fence whether the creepiness is worth it, though. Seems like there are easier alternatives like "graylisting" where a transaction is in a pending state for 2-3 days where it's cancellable (and maybe can be expedited with a phone call). Seems like that'd offer a nice middle-ground between scanning your computer and protecting from scammers.
So there is a lot of incentives to detect hacked clients.
Banks should be on the offense against fraud by default.
As one of their customers, I think their password policies are extremely unhelpful to creating secure logons, and make it almost impossible to use a password manager.