I still can’t believe American banks lets you login with just username / password? Surely there is some id check or at least two factors involved?

That would imply they have to test that the credentials are correct though.

Otherwise I can just put somebody's user and put some fake password and they would reset it and disconnect the account of that user and annoy him.

But the username is still public, you can change the password but if your customer is idiotic enough to blast both out into the internet, the password will just get a 1 or ! After the password they used before...

I get why you're saying that since it was Xitted at/tagged Bank of America. But it was still a public post from the user's account. That's like assuming a company could delete one of your emails or your Facebook post.

No, but they could have (and maybe have) block access to their bank account as a precaution.

a friend of mine was telling me that their parents got scammed recently out of 200k. They were trying to work out how and why and everyone, including the victims was just like "I dunno... it just kinda happened. Everything looked legit."

And I imagine if "buying something on amazon" looks really confusing to you, there's little difference between that and a scam, because it's all a mystery you can't hope to comprehend.

Now I imagine that experienced or savvy people could smell a rat instantly, but if you truly find online payments way beyond your Ken, I can see how it happens