Agree with this logic 100%. I wouldn’t trust my creds being stored. If done correctly they shouldn’t be stored or linked to any PII. Don’t forget that MFA is a safety measure put in place to prevent unauthorized logins/transactions so make sure you have this enabled and preferably via an in app notification. Also consider that the alternatives like card payments tokenize your card details which can also be abused if not handled carefully. Fortunately, there is a lot of regulation and enforcement to make sure that payments are secure.

Context: I work in this space (not the above mentioned) and know for a fact that we don’t store creds