I imagine they do their best to run a tight ship yes, but I also imagine the fact that banks still run a lot of legacy pipelines and audits means it's also a little harder to find bugs in the apps and websites, that would actually let you achieve much.