The trick here was that of course my friend did not use her own sensitive bank information to ask for the loan - she asked for test data, and the company provided her with data. What she did not realize is that the data they fed her were things she had created in her own name earlier in the scam. For example, she opened a bank account in her own name quite early, after some trust was built. The data she used for that didn’t seem that sensitive to her, and she made sure the account was not a paid one and so on. And she was right - that account in itself was not what screwed her over. Days to weeks, and dozens of assignments, later when she applied for the loan, the test data they provided to her upon her request were partly from that opening of a bank account. So from her perspective it was a competely new flow to test for an existing customer - the bank - with test data provided. They even changed the login data a bit so that it looked like a different account. Since this was framed to der as a test as close to reality as possible it didn’t seem off that the „test account“ showed her her own name.

From the perspective of the bank it was an existing, verified customer applying for a loan. This was a really, really clever bit of social engineering.