Firstly regarding VPN protocols. PPTP is the oldest and least secure, it has several known vulnerabilities that allow hackers to break in to it, you should not use PPTP. L2TP is the next step up it also has some vulnerabilities but is much better than PPTP, Apple's own VPN server only supports PPTP or L2TP so if your using Apple's VPN server you do not really have a choice other than to use L2TP. Cisco IPSec is probably the next step up, if you use this with certificates as well it is still reasonably secure and adequate for most people. Beyond that there are various https based VPN systems and the very latest system is IKEv2 again optionally with security certificates.
If you build and run your own VPN system or use one built-in to your router then you have control of which protocol to use and whether to add security certificates as well. If you use a commercial provider then you need to check what they are offering, as mentioned PPTP is a waste of time so dump any provider only offering that.
Now while a bank website itself will (hopefully) use https to encrypt its traffic, the problem is that traffic over WiFi between your laptop and a WiFi hotspot is still vulnerable, it is very common for hackers to either be connected to the same Internet cafe hot-spot or to even set up fake hot-spots. This is where using a VPN is needed. With a VPN the traffic is then secure all the way from your computer to the VPN server at the other end and this if you use a decent VPN system i.e. not PPTP means hackers are unlikely to be able to observe your communications.
You of course have to also remember to connect the VPN system. This is why for our company I have setup a 'VPN on Demand' setup which automatically connects to the VPN server so I don't have to rely on users doing this.