1. Apply for loan under Bob Smith's name using stolen/forged identity
2. Company providing loan will only send to a bank account in Bob Smith's name
3. Provide the company with Bob Smith's real bank account details
4. Message Bob Smith, "oops, we accidentally sent you $x in error! please send it back"
5. Bob Smith now on the hook for proving they didn't apply for a loan