A bank's API rarely leaks sensitive data on purpose. Nobody writes a line of code that says send the customer's full account number to anyone who asks. It happens in smaller, quieter ways, a response object that includes more fields than the frontend actually needed, an authorization check that confirms someone is logged in but never checks whether they should see this specific record, a log line that was only meant for debugging but ended up storing a full card number in plain text.
If I were brought in to look at a bank or fintech API that had a data exposure problem, these are the four places I would check first, in the order I would check them.
First, what the response actually sends back, not what the code assumes it sends
The most common leak I see is not a security bug in the traditional sense, it is an entity object being returned directly from the database without shaping what actually leaves the server.
@Entity()
