Security :: Transmitting Encrypted Passwords In URL

Sometimes when web sites logon automatically with your password - these passwords have to be stored somewhere - and transmitted. Since these are often transmitted in the URL anybody can intercept your data if they are so inclined - so a hacker doesn't even NEED to use any password cracking technology -- just using your data stream presumably they could logon to your Bank account and empty it.

How the system works but the password (encrypted) has to be transmitted in the data sent to the target website and most of the data string is initially sent as a string in the URL.

Explain either is this TRUE - or is it FALSE. In any case especially with Banks etc I always set to completely logoff -- however it doesn't prevent the essential weakness that a string is sent to the target web site over the public Internet and this string can be intercepted - and replicated.