In my experience, banks are among the worst at following email standards. Why would we expect more sophisticated security protections from them?