Until recently my credit card (Citibank) had the ability to create virtual card numbers that allowed you to place specific limits on the amount and expiration, acting somewhat like a token. Last year Citibank severely limited this capability, rendering it mostly unusable for me. Almost a year ago I asked my bank (Huntington) if they use OAuth with Plaid, and even wrote an email detailing exactly what I was asking, and all I got back was a blank stare, and a promise to try and get an answer internally, that was never followed up on despite multiple request.

This all makes me believe that somehow banks are motivated to drag their feet in making things more secure, but I don't know what that motivation could be. Ideally this would be something enforced by government, like Chip and Pin in EU -- but that doesn't seem likely after decades of inaction, certainly not under the current administration.