This is an interesting article that should probably be in /privacy instead of degoogle. It doesn't say explicitly but the surveillance vector sounds like it has to be a bank app running on the user's phone. Obvious remedy is never install that type of app. I've managed to do that so far.

Added: oh I see, this thing is spammed all over the place. Downvoted for spamming.