Comment by tptacek

It's not just TLS's job to authenticate your transactions; your financial institution also runs its own authentication system, which should ideally break phishing and reframing attacks (for instance, with WebAuthn).