> Conversely, what stops bad actors just switching to doing transactions for t_rdigr_de, ta_dig_ade, or tar_igra_e and thumbing their nose at the filtering? (OK, realistically they would probably switch to some more obscure backup code but you get the idea.)

This literally happened at HSBC. Employees entered transactions in exactly the way you're imagining.

(I didn't find a written source, but this is covered in Netflix's "Dirty Money", episode "Cartel Bank")