I suspect the attacker had (maybe still has) full access to her laptop. They wiped her phones, so I am assuming they are clean of malware and trying to get her

I suspect the attacker had (maybe still has) full access to her laptop. They wiped her phones, so I am assuming they are clean of malware and trying to get her to do everything from the phone which should be clean and not the laptop which we have to assume is compromised.