diff --git a/scripts/taler-bank/demo-withdraw-api.py b/scripts/taler-bank/demo-withdraw-api.py
index c5ca797..68c7e8a 100755
--- a/scripts/taler-bank/demo-withdraw-api.py
+++ b/scripts/taler-bank/demo-withdraw-api.py
@@ -124,9 +124,8 @@ def mint_withdraw() -> dict:
 
 
 def _rand_username() -> str:
-    # bank usernames: keep simple [a-z0-9]
-    alphabet = string.ascii_lowercase + string.digits
-    return "guest" + "".join(secrets.choice(alphabet) for _ in range(8))
+    # goa-bank-acc-<uuid> — unique guest id, bank-safe [a-z0-9-]
+    return "goa-bank-acc-" + secrets.token_hex(8)
 
 
 def _rand_password() -> str:
@@ -139,7 +138,9 @@ def create_personal_account() -> dict:
     """Public registration: auto username/password, balance starts at 0."""
     username = _rand_username()
     password = _rand_password()
-    name = "Guest " + username[5:9].upper()
+    # short label from id suffix
+    suffix = username.rsplit("-", 1)[-1][:8]
+    name = "GOA bank acc " + suffix
     code, body = http_json(
         "POST",
         f"{BANK}/accounts",
@@ -153,6 +154,8 @@ def create_personal_account() -> dict:
         # retry once on conflict
         if code in (409, 400):
             username = _rand_username()
+            suffix = username.rsplit("-", 1)[-1][:8]
+            name = "GOA bank acc " + suffix
             code, body = http_json(
                 "POST",
                 f"{BANK}/accounts",