Man-in-the-middle attack
He forwards the data sent to his server to the real www.bank.com, and relays the data from www.bank.com back to the user, capturing the username/password, and all the transactions in the process.