Can a bank know exactly who its customer is and still miss a scam? Increasingly, the answer is yes.