Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

Availability refers to the loss of access to or interruption of access to an information system, data, or a service, which is not the primary impact here.

Confidentiality refers to the unauthorized disclosure of information. While there might be some confidentiality concerns, the primary impact of *changing* data is on its integrity.

Scope (in CVSS v3.x) indicates whether the vulnerability's impact extends beyond the vulnerable component. While it could affect scope, integrity is the direct metric for data alteration.

The CVSS Integrity metric refers to the trustworthiness and veracity of information. An attack that replaces a bank account number directly compromises the integrity of that data by making it inaccurate and unreliable.