Yeah, so the problem is that the account number plus short code had no checksum validation. This is the banks fault for implementing a rubbish account system. A proper system would look more like this sudo code:

1234567890-1234-checksum(1234567890-1234).substring(0, 6)

where 1234567890 is the account number, 1234 is the short code, and then 6 characters are typed in at the end are a checksum.

The short code is unique. So if you type in the correct checksum but not the correct short-code the fully-qualified unique identifier does not pass the validation step. Like-wise, if you type in the correct short-code but not the checksum then the unique identifier also does not pass the validation step. Thus, the user is protected against typing in an incorrect short code.