Dear Raccoon
You are mistaken. Internet Banking generally comes with two passwords. ONE, loggin password, TWO transaction password. With the former you can find out details of your account, with the later you can perform financial transactions.
In the case of your mobile, R world authenticates into the Banks server by quoting you cell number. This is the same as sending an sms from your cell to the bank and getting a reply sms with your account details, a service provided by all mobile operators. Once you register your phone with the bank, any one who has access to your phone can find details of your account, by sms or R world. It is like a digital passbook.
Coming to the main point, R world does not allow real FINANCIAL transactions as of now. When they do start this feature, I hope and I think they will, ask for the TRANSACTION PASSWORD. So, for now, rest assurred that your money is safe.