[tjoff]

If you are making up random usernames on a banking site, attackers aren’t going to know your username. So it is two-step.

The username isn't supposed to be a secret, social engineering will most likely be very easy.

[fbdjskajxb]

Agreed, but this is true whether or not you’re using parent’s plan of not knowing the password.