For example, in New Zealand: https://www.stuff.co.nz/business/110009318/a-honeypot-for-fraudsters-or-a-simple-way-to-pay-online

That's 3 years ago, and nothing has changed.

As far as I can tell, the 3rd party system has to have your online banking password, because nobody can figure out a reliable way to give a description of a one-off or regular payment in a format such that you can enter it yourself into your online banking without making a silly mistake.