> all i have to do is come up with a website that looks enough like your banking app, and get you to scan the uri to that website, and that'll trick you into giving me your pin.

It is not how any of this works. But sure, keep up the uninformed fear mongering.