Developer.com article about my security alert finally made it up. It's been 4 months since I notified some of these sites and they are still not fixed. Note that the worst hole is with Citibank and lets one transfer cash out of users bank accounts through their c2it cash transfer site.