He may not have been using his phone for transactions.
A lot of websites and financial institutions have two-part verification where they send a code to your phone when you try to log in.
Snag somebody's phone number through a SIM swap and you get the verification text.
That's why I have one of these:
What’s that in the picture?
I’ve been using Yubi Keys for 10 or more years. But how do you get it to work on your phone?
What is that?
Sorry to be ignorant.
WTF is that?
..and that is?