1) Web Hacking: is a good options (Sqlinjection for example) to you can retrive DB from sites.
2) Stealers: a one execution malware that capture saved accounts and tokens.
3) MITM & Sniffing: you can join a public network and see what everyone is doing, including bank transactions.