When the bank redirects customers to a site outside the bank's domain for certain transactions without warning, it has failed to maintain a context for good security decisions, Prakash said.

He found this problem in 30 percent of the banks surveyed. Often the look of the site changes, as well as URL and it's hard for the user to know whether to trust this new site.

The e-mail data path is generally not secure, Prakash said, adding that 31 percent of bank websites had this flaw. These banks offered to e-mail passwords or statements.

The researchers will present these findings at the Symposium on Usable Privacy and Security meeting at Carnegie Mellon University Friday.