"...the one recourse we have is to let these organizations know that they won't be getting our business if they can't be good stewards of our data."
@Drew Conry-Murray I couldn't agree more. If you don't live up to your end of the bargain with them ( banks ), they have no problem using the tools available to them, so what do we do when they don't live up to their end of the bargain ?
Just as you say, take your business elsewhere, because that is all most business and especially banks understand. Anyone who still holds an account at Chase is condoning their amatuerish security measures and should be prepared to have their identity compromised at any time. Heck, it already has been.