I'm assuming that's the clever bit. The scammers got the victim to apply using their own personal data by hiding that fact behind the account number.
I guess it’s possible the scammers scoped out banks and found the shitty ones with inadequate practices…