Product: Payday loan, title loan, or personal loan

I received a mailing stating that I had been pre-approved for a loan from {$2000.00} to {$10000.00} from XXXX XXXX. I went to the site and was asked for some basic information, name, address, monthly income, pretty generic, and was told my Credit Score was XXXX. I was invited to fill out an application which was " guaranteed '' not to affect my credit rating, which I did, including this time, more personal information, but still nothing I felt uncomfortable about. The company responded online within a few minutes, with a loan contract and repayment agreement, stating that I qualified for a loan of {$3500.00} with a 60 month repayment @ {$200.00} per month. I have some higher interest loans that I wished to consolidate, and after doing some calculations determined that if I payed an additional {$50.00} to {$100.00} on the principal with each monthly payment, I could save several thousand in interest, based on contract language, so I opted to sign, digitally with my SSN and bank account information ( routing and account number ), assuming that as the document is Titled Contract for Loan Repayment, and asks for a signature, so the monies will be posted to my bank in one business day. 
After completing the contract signing, agreeing to repay the amount plus interest as stated, I was presented with a screen telling me that in order to process my 'application ' they needed to verify my banking, identity, and income information. To do this they required that I furnish them the userID and password to my online banking application. Those credentials allow a person to open a credit card in my name, apply for a loan, transfer all of the monies out of not only checking but all of my bank accounts, default on the automatic bill payments I have set up, and worst of all, change the userID and password to my online banking application. This is expressly forbidden by my bank, giving a third party access to my online banking credentials. I contacted XXXX  as soon as their customer service opened and advised them of this, and was told, that they would have to deny my application for falsification of information, and send that to the credit reporting agencies. I explained that I can export all the information in my checking account as well as many electronic bank statements and send them to their office via secured, signed, with Certificate,  documents. The agent told me that the only way they could get my bank information was for me to fill out the online request for my user credentials. I further explained that my bank will be more than happy to send them directly any information they request, the agent again said the only way they could process the loan was to fill out the form request for my secure credentials. I asked for a supervisor, the agent returned to the phone is less than one minute saying that there was no supervisor available, and that if I didn't give them my userID and password by XXXX at XXXX. they would deny the application as described above, and trash the credit score I  have worked so hard to rebuild after a serious accident left me XXXX XXXX XXXX  with a XXXX injury. This appears to be a spoof or fishing scheme, and now they have my SSN and other information such as bank account number and routing number. Can a company do this? If so, I will launch a web site today and start making money ... They should accept the information as provided them directly from my bank, and process the loan accordingly, at least then they will have to come up with a legitimate reason, which there isn't one in my bank statements, for denying the loan and trashing my credit. I am sure there are hundreds of elderly and XXXX people out there who have received these offers and have been caught in the same trap I have. Please help me to shut this operation down, and prevent them from trashing my credit. I am considering writing XXXX myself today, and warning them in advance what these crooks are trying to do. They could be 2 teenagers in a bedroom in XXXX, OH robbing peoples bank accounts blind as I type, and if you disclose the credentials on purpose, the bank is under no obligation to cover the losses. HELP!!!!!