Is it? What if "Starbucks" were your bank? What if you knew that apart from your bank there's non-bank entities mimicking your bank's looks in an effort to get your personal information? Would location still be irrelevant?
They mimick the look of the bank and pick a domain like your.bankofamerica.getreadygo.com
Mousing over the link, I saw https://www.bankofamerica.com/[lots of gobbledygook followed by an ellipsis]. So, to see it all, I copied it to the pasteboard and pbpasted it into an open Terminal window. The gobbledygook ended with an @-sign and a domain that resolved to a Chinese IP.
About the @-sign syntax: http://stackoverflow.com/a/4981309/315083