Banking “spyware” opens questions about who is spying on who