Someone asked me to login to his bank account and make transfers to another account

The scammer gave you login credentials to account X and had you move money to account Y.

The scammer didn't own account X. What is likely is that the person who owns account Y was told "I" will transfer $5,000 to your account, you keep $500 and send the rest as a money order to this address. The reason why account Y now appears invalid is that the owner of Y may have alerted the bank or the police.

When the authorities trace the transfer, they may track the login session to you.

The scammer also learned that you are willing to help them, at least for a little while.

This sounds like the definition of a "confidence scheme", in which the scammer does things which at the beginning seem legitimate or, even if suspicious, work out exactly as they promise they will. Naturally it starts with small amounts as 1) a way to lure you in ("it's only a few bucks, what's the harm in that?" you might think), and 2) to build up your confidence in what they're telling you.

It gradually progresses to bigger and bigger amounts, then they start changing the game, asking to use your accounts or more of your money. Then they strike, take you for what they can get (which by then is usually a much more significant amount that you would miss!), and they're gone. Or worse, they get you to somehow involve friends or acquaintances, who might be the REAL targets (you're just the unwitting dupe in the whole thing), then you're stuck dealing with the aftermath.

ANY TIME SOMEONE YOU DON'T KNOW APPROACHES YOU ASKING FOR YOUR HELP IN MOVING MONEY AROUND, RUN!!

There's a reason why they won't do it themselves - what they're getting you to do is most likely illegal, or they want to make sure it can't be traced back to them in the event it isn't criminal in nature but could open them up to civil suits.

The mere fact that you, by your own statement, know it's a scam and posted here asking questions is enough to tell you to give it a wide berth. And unless it's merely for the sake of curiosity, does it matter how the scam actually works? (grin)

Since the bank account is fake, it's practice.

The scammer is actually cultivating you. It's a confidence game, but in a form called "the long con".

For scammers, the limiting factor (the scarce resource) is the human resource: the scammer's own time. They can't afford to waste their own time working with skeptical "marks" who will ultimately refuse, or who will scam them right back to waste their time.

So they use elaborate methods to try to screen out those people.

For instance, consider Nigeria. Most people know Nigeria is associated with scams (and it's the only thing they know about Nigeria lol). So why on earth do so many scam emails mention Nigeria? There's a reason - they actually want to repel away the skeptical -- so they only deal with the gullible.

Also, a confidence game is about building confidence. For instance:

• In some money-transfer scams, they sign victims up "as employees" and give them simple, zero-risk, zero-harm tasks like finding a low-price airline flight. To the victim that feels like real work done, and makes the victim more confident in the legitimacy of the work. Next they send money to the victim to buy common office supplies to be mail-ordered "to the scammer", and they make sure that transaction goes smoothly. *This makes the victim more comfortable with money transactions. Or alternately, the victim has said "Heck no, won't do it" - they are screened out.

• Next, they know Bitcoin ATMs are alien to the victim, so they have them do more "harmless tasks" - such as finding local ATMs or taking photos of the ATMs. After that, they have the user step up to the ATMs and navigate the menus, with some excuse like wanting to see the software version used. Again a zero-risk, zero-harm activity, but the victim's confidence is rising that this is a real job, and their reluctance to interact with Bitcoin ATMs is falling.

• Then, with the victim well-groomed, they start wiring money to the victim's bank account and having them deposit the cash in the Bitcoin ATM. That victim would have never agreed to that if that'd been their first request! But since all of this feels like "old hat", their guard is down.

The above is how the "long con" works.

The scammer's ultimate goal is to wire you (stolen or fake) money, and then have you wire that onward to them in a different method (Western Union, Bitcoin) which is irreversible. Then, when the stolen/fake money is exposed, you are left holding the bag.

As with the Bitcoin example, they know you'd never agree to that until you gained some confidence. So they have set up this fake banking site to let you play with fake money, so you gain confidence in their legitimacy. Eventually, after this type of thing "feels like old hat" and your guard is down, they will ask you to do the actually dangerous thing.

Note that this works best when the scammers can "automate" all this screening and confidence-building, so that each victim being groomed will take the least amount of their time. Controlling the bank website makes that easy for them.

Once they have manipulated your confidence, it'll become this.

"couldn't do it by himself for a couple of reasons".

1. The legitimate account holder will claw back the money after detecting the theft
2. they would follow the money to me, and I'd go to jail

Those are the reasons. Better plan:

• Find a (second) victim.
• Have victim 2 transfer money from victim 1's account to victim 2's own account
• Have victim 2 transfer money from own account to mine
• except, use a different transfer method that is irreversible
• I have the money. Woot!
• Victim 1 detects fraud and claws back money. Victim 2 sees account go negative.
• Victim 2 tries to claw back money sent to me. Can't, because I chose an irreversible method
• Victim 2 left holding the bag. #notmyproblem

Yet another possibility is something along the lines of:

• they ask you to perform an operation
• they have the website display the outcome of a different operation instead
• they claim you screwed something up and sent more money than you were asked to
• they demand you compensate them

A recent video by Mark Rober showcases a real-life scam, primarily targeting older people, trying to guilt them into sending money in a way somewhat similar to what you describe.

YOU NEED TO CONTACT A LAWYER IMMEDIATELY!!!

They will recommend whether or not you should contact the police, and (if not) will advise you if (when?) the police come looking for you.

All the other answers explain possible details of the scam, but none of them spell this conclusion out explicitly!

You have almost certainly logged into an account and transferred money out of it, without the knowledge of the owner of that account. Depending on the jurisdiction, it seems likely that this is a criminal action. Some jurisdictions may not take into account that you didn't understand/know what you were doing.

Either way you need to get professional legal advice IMMEDIATELY!