Your mouse movement and keyboard events are available to webpages that you’ve loaded, when the browser window is focused.
This isn’t nefarious - it allows websites to build nice UIs that most people enjoy using, most of the time.
There’s lots of shady stuff going on in browsers, this isn’t really one of them.
I’m guessing you’re talking about debit cards. From the Canadian Government: yes.
In detail:
If it’s possible, then it’s a revenue stream, so I assume it’d be done.