I'm going off of this answer, but asking a new question since that's quite old.
It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username and password in order to verify account information quickly. This flies in the face of the age-old security advice: "No legitimate organization will ever ask for your password". The answer I linked above seemed to imply that this is an inevitable evolution of banking and that there's not much to be done about it.
But what I don't understand is this. This seems like the exact use case that OAuth was built for. The Wikipedia summary begins as follows.
OAuth (short for "Open Authorization") is an open standard for access delegation, commonly used as a way for internet users to grant websites or applications access to their information on other websites but without giving them the passwords.
The user story for these bank identity verification popups seems to be this: Service X wants to know that you are the owner of the bank account Y. They do this today by either (the old method) dropping two small (less than $1) transactions into your account and asking how much money they just deposited, or (the new method) asking for your password directly.
But if bank Y supports OAuth, couldn't service X just request delegated access to the account, in the same way that my Mozilla Thunderbird installation requests delegated access to my Google Calendar (crucially, at no point did I share my Google password with Thunderbird)? Why aren't they doing this? Is there some technical limitation I'm not seeing here?