If you're on Android, apkmirror.com or another similar site is a good and safe solution.
Maybe we should ask all banks to publish their apps via F-Droid build service so the build hashes on both the Play Store and its mirrors can be checked for third-party modification.
Expecting my bank to listen to suggestions about publishing hashes for F-Droid users is not realistic, so assuming that they would never do this, how would I verify the app outside of the Play Store?