Sites like Mint do this to retrieve your banking history. Asking for banking login details seems to be the standard way of doing that sort of thing. (Don't get me wrong, it's still terrible, but it's not like the banks provide an API you can log in to with oAuth or something.)

This is different; mwave is a retailer, all they're doing is receiving a payment.