limits of end-user "testing"

[Jeff Robertson <jeff.robertson () digitalinsight com>]

People occasionally ask me if I can help them figure out if the online
banking site they use is secure. I tell them not unless the bank hires me to
do so.

Is there *anything* that an end user can do in the way of checking for the
Top 10 type of problems, that would be considered "fair use" (I know..
copyright law term, not really applicable here) or "self-defense" rather
than malicious?

For purposes of simplicity and relevance to my current location, lets assume
that both the user, the website, and the company that owns the site are all
in the U.S.