A majority of websites floated by banks have design-related flaws that could make customers vulnerable to cyber-theft, endangering their money or even their identities, a study has found.