He may not have been using his phone for transactions.
A lot of websites and financial institutions have two-part verification where they send a code to your phone when you try to log in.
Snag somebody's phone number through a SIM swap and you get the verification text.
That's why I have one of these:
