At what point do they say that? Are those your assumptions? The bank might have failed to provide proper controls to secure the account. As example, 2FA is not

At what point do they say that? Are those your assumptions? The bank might have failed to provide proper controls to secure the account. As example, 2FA is not common for banks in Canada. If the client's computer was compromised, 2FA should have secured the access to the account.