Banks and credit unions hold more first-party data than almost anyone, and still can't see what their audience does outside the app. Here's what an outside read finds.