Banks told to address online security 'loopholes' that could leave customers