They can see that someone opened a tracking pixel from $BANK (or wherever), and, with your other activity, potentially tie that to you.