In a comment, you clarified your question as,
What is the set of information that must be secured to prevent scammers clearing your bank account?
The good news is, banks have evolved security and fraud protection as they've added services. Since the focus of your question seems to be around scams that rely on access via online banking, the typical features are:
Two factor authentication, just to log in, with some degree of "intelligence:" You may only need your username and password to log in, but the online banking system will challenge you for a second factor before it actually logs you in, if your access attempt fails certain tests. Often, the bank is using a scoring system that evaluates a series of factors and decides what to do. Besides requiring a second factor, banking systems will also sometimes lock someone's online access if there is enough suspicious behavior:
- Failed username/password attempts
- Logging in from a device you've never used before
- Logging in from a browser you've never used before
- Logging in from a browser on a mobile phone, when your mobile phone login history typically comes from the bank's own app
- Logging in from a zipcode, state, or country that you've never logged in from before
- Logging in at a different time of day than is normal (i.e. all your history is during daylight hours and suddenly there's an attempt at 2 AM in your timezone).
- You've reinstalled the online banking app since the last time you logged in
- You've recently installed the online banking app on another device and attempted to log in, but were stopped because the password was bad
A different type of multi-factor validation, when suspicious activity happens, once you're actually logged in. Most banking systems will also actively challenge a customer who tries to make unusual transactions. For instance, the customer may be challenged to enter a PIN that's sent to their phone via text if they're adding a new bill pay account, if they're making a bill payment or external transfer over a certain threshold, or even if they're transferring more than $1000 between their own accounts.
Passive notification of suspicious activity: Many banking systems will passively notify customers when certain transactions happen, even if all of the above challenges are passed and the transaction completes - this is designed to at least notify the customer if someone has "broken in" to their account or it has otherwise been compromised. Often, these notifications are designed to use different channels than the multi-factor challenges, so for instance if a large transfer requires a PIN sent to a cell phone, the notification will be made via email or an automated call to a different number on record for the customer.
There are also cases where banks implement passive notifications via actual mail - for instance, if you change your online banking password, you receive a letter in the mail notifying you that you did this. This is designed as a last-ditch notification to help people who have had their entire digital identity compromised unknowingly (i.e. if someone knows how to access your phone and has access to your online banking app and your texts).
To address another point you made in comments,
If the answer is "your username and password" then I am safe, but would not seem to be much of a sophisticated con
In a sense, you're kind of right - a scammer may theoretically be able to gain access only with your username and password but there's a gray area in terms of if they'll actually be able to log in, or what they may be able to get away with once they have logged in. The "sophisticated" part comes into play in the sense of tricking the mark into bypassing or ignoring all of the above controls - the con will have to talk the mark into giving them the PINs that are sent to their phone, or even calling the bank and unlocking their account if their online banking access gets locked out because of failed login attempts.
Which is the whole reason why most banks implement active fraud prevention by bank staff: probably the most common way that a social engineering attack is stopped is by bank staff actively monitoring for suspicious activity and then taking action to protect the customer. Besides watching for members hitting or failing the above triggers, there may be other things the bank is actively monitoring - often based on behavioral triggers (someone doing something they don't normally do), quality triggers (someone has check images show up that are on the verge of failing verification), or time boxes (someone creates a new online banking account and immediately tries to withdraw all their money via transfer). Sometimes staff will take corrective action by putting a hold on the account or specific transactions, shutting down online banking access, calling the member, or other methods to prevent fraud.
Banks will purposefully try to hide the details of their own fraud prevention tools from the public, to prevent cons from focusing on their weaknesses. If a bank has a sufficient set of tools that are not well understood by the public, then in order to be successful, a con will need to truly secure the full confidence of their mark, versus just trying to weasel specific pieces of information out of them. Once a mark has been tricked, none of the above factors will prevent loss.
To bring this all full circle to your original question,
What information / help would a scammer need to make these payments?
The answer is, it depends on the bank, but typically they would need your username and password, along with full access to information that is intended to be confidential between you and the bank (i.e. PINs sent to your phone via text, phone calls, emails, etc) in order to defeat typical fraud controls. In other words, if the bank is doing a good job at fraud prevention, there isn't a predefined list of things the scammer needs - the scammer needs to trick you into helping them evade whatever measures their activities trigger.
