Re: What could possibly...?
Speaking as someone who has been sent numerous phishing emails for various banks (but weirdly never my own) the other person isn't paranoid. I don't use online banking because:
I know therefore that anything that asks me to log into my account is bogus.
I don't need it because I'm lucky enough to have private banking. If I'm transferring money and make a mistake it's my fault. If they do the same it's their fault and they're liable.
I've never had a problem with Amazon or Ebay via PayPal but that doesn't mean I'm not cautious when shopping online. I try not to do anything on my phone that requires my financial details because I don't 100% trust that the thing hasn't been compromised. The reason I don't have contactless cards is because they interfere with my Oyster card. I have an annual travelcard loaded on the Oyster. It's bloody annoying having to get the card out of the wallet to use the bus/tube/train. I did have a contactless one for about a fortnight but I was forever getting stuck at the barrier. The bank happily changed the card to a non contactless one.