Formsauthentication not onlywrites the user's name into the cookie, itaddsamessageauthentication code (ahash formed from the cookie and a secret value that only the Web serverknows).
If the bank finds that the user answers in short order all its many questions correctly, it will transfer to his laptop a cookie which includes an encrypted token, which further includes a key and a "hash number".