Sounds like...
... good old police work. Which is nice.
What is not so nice is that you can't expect banks to take this as a wake-up call. Their main security has been in obscurity and denial, or maybe paying off the victims. That's all there is to it, fancy tech notwithstanding. The automated infrastructure models are very much copies of a 19th century paper bank.