[pjc50]

It does sound like bank transfers - either SWIFT or Faster Payments. If it's a backend attack they could well have bypassed all the usual checks, including checking for positive balance & overdraft limits.