nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq9zsljfx8tjyzplququr9xmqctclx0qc2mw5xydzx0udqzrfade4qmtrtl5 (nprofile…rtl5) nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqxcqtemjrdz9zgrsqtg0l7klakq39jwvh35tz722havjx5zn59sgsyh58n4 (nprofile…58n4) true, fido2 would have prevented it probably. So would a passkey have. (Because neither would them have wanted to generate anything because they saw that the URL didn't match)
(But that's of course assuming that the bank supports either of these....)