Can't be solved completely, anything can be social engineered. But thats no excuse for not solving as completely as possible. I couldn't discern from the articl

Can't be solved completely, anything can be social engineered. But thats no excuse for not solving as completely as possible. I couldn't discern from the article the extent to which any technical vulnerabilty was involved -- or if it was pure social engineering, eg with the criminals using the info they had gotten out of the user to gain access to their accounts via more social engineering of their bank? Was an Android system exploit involved? Was the malware app able to escalate its privilege and access info from other apps? If either of those, what about Android's security model or implementation needs to be further hardened? (Naive questions, I'm neither a security nor a Android engineer.)