Same thing with my World War II vet father, except for the bank accounts.
If they gained access to the bank accounts then at least one of the following took place:
1. The legit user had spyware on his PC when he accessed his account online.
2. They found a cheque for the account and used the routing codes to set up a bogus debit.
In either scenario the best course of action is to clean the computer and install a good anti-virus app (AVG is good and it’s free), then get a new bank account number and card, and set a new password for online banking.