 <p>That essentially boils down to a phishing attack. This isn't something that can easily be prevented from a technical point of view, unless there's mutual agreements between all authentication partys involved. Some banks now show an image that the user selected. In effect, the bank is trying to prove that they are that actual bank (because they know what image you chose during registration) and the user is providing the bank with a password to show that they are authorized to access the account. </p>