Right, but if you transfer that money away before the bank gets it back then you would be liable for that part.
I understand what the law probably says, I'm arguing that it's nonsense. The scammer stole money from the bank in this scenario because the bank fulfilled a fraudulent loan application without due diligence of ID confirmation. The fact that this could be Bob's problem demonstrates how dystopian our legal system is.