lol not mine, just saw the post on reddit.

If the phone is locked, they just transfer the SIM to another phone and then try to sign in to all the banking apps using the phone number.

Password is not an issue because they just do the lost password procedure which will send the reset links and 2FA codes to the same number.

Agree on blocking transactions, but that's a race between you (currently with no phone) and the thief. And you need to sit through the stupid robocall and try to recall your account details.