She opened the bank account and applied for the loan at separate times. So she wasn't aware that the loan being applied for was related to the bank account previously made.

Exactly. From her perspective, she had Task A: open a bank account for client SomeBank, performed that task and way later had Task B, apply for a loan at SomeBank. It's not at all suspicious to perform those tasks for the same customer, and the "test data" given to her looked legit (it's because they were the actual data from Task A)

I still don’t get it. Presumably there’s more information needed to apply for a loan than a bank number, such as name, DOB, and address (and maybe SSN or other personal ID, depending on country). What data was used for that?

The bank presumably already has that from the KYC on the open account.

I'm assuming that's the clever bit. The scammers got the victim to apply using their own personal data by hiding that fact behind the account number.

This doesn’t make sense to me either. Even when opening a new CD at an existing bank it asks me to confirm the address on file.

I guess it’s possible the scammers scoped out banks and found the shitty ones with inadequate practices…

At least in the US that seems highly unlikely, specifically because of KYC.

I understand that part of it.

This is the line that is confusing me:

> Of course she did not provide any personal details

How are you getting a loan without providing personal details? I’m not aware of an institution that will give you a loan by just providing a bank account number. It seems to be based on the description that the only data that wasn’t personal was the bank account.