I'm guessing he does it by being a bank himself (ad for a bank safety campaign).

The real bad guys have other methods, which you can google (try "online financial crime").