Sure, which still means that they managed to get the password. But they neeeded anyway the login (here it is a customer number, usually). I was referencing th

Sure, which still means that they managed to get the password. But they neeeded anyway the login (here it is a customer number, usually). I was referencing the parent post because - like everyone else - is talking about SMS interception as one of the major flaws in the authentication process, the way this scam has been carried seems instead to make it (the SMS code) the only thing that would have stopped it (if the victim hadn't revealed it, several times).