I saw a thing recently where a unicode encoding trick was used in an oauth phishing scam -- using unicode characters, a scammer was able to make an oauth connector that looked like the real company but passed through the company's "if (oauthConnector.name.toLowercase().contains('our name')) { throw new DenyError();}" check.
Now, it's up for debate whether any (psuedo?) financial institution should offer full oauth access (at least without having a human review possible oauth connectors), but the point is, decorative hackernews submissions are the least malicious use of this trick.
The user though the oauth app was legit because it was the "same" as the company name, accepted the connection, and promptly had their account emptied: https://www.reddit.com/r/Bitcoin/comments/2lt76n/warning_coi...
Now, it's up for debate whether any (psuedo?) financial institution should offer full oauth access (at least without having a human review possible oauth connectors), but the point is, decorative hackernews submissions are the least malicious use of this trick.