This is reasonably sophisticated, and it is easy to see why people fall for it.
- The scammer calls you up. They keep you on the phone while...
- The scammer's accomplice calls your bank. They pretend to be you. So...
- The bank sends you an in-app alert.
- You confirm the alert.
- The scammer on the phone to your bank now has control of your account.