Something quite similar happened to a relative of mine this summer in France. A scammer impersonating bank support. He called Friday 16h30 mid holidays. He proposed to help reduce fees by disabling not needed options, while in fact he was triggering a text verification code. The text doesn't specify the reason for the request.
He got in. Then did a few other useless operations during 15 minutes that required email confirmation which state what they are requiring it for. Those had mainly two purposes : help lower the guard and provide cover for the initial false requests. He kept smooth talking explaining that because of the various changes they should expect the bank app not be available and that everything was normal. Then he went for the option which allows to activate instantaneous bank transfers which required both email and phone verification code.
My relative was about to read it to them, when his wife smelling something fishy was happening put me with him on the phone. He was so convinced that everything was normal that I almost can't convinced him to hang up. What did the trick was telling him : "hang up and call back the bank before continuing".
My relative thought he was safe because he never gave the password of the bank app, nor the web password. But for our bank, this 4-digit pin password you put in the phone app is not a real password it is just a per-device off-line password you pick upon first device use to disallow someone stealing your phone to have access to your bank account too easily.
After he hang up, and I succeeded to talk some sense into him. I convinced him to call his bank. It was past 17h00, so it was closed. I told him to call emergency security which he did. But the number is typically used for lost credit card ; so they did the only thing that they usually do : revoke credit card and send a new one. Which is basically useless because the scammer wasn't about to use the credit card number to buy something online but he was initiating some wire transfer via the app.
So I had him call again a few times reexplaining the problem more precisely, or at least told them to block wire transfer for the account. Maybe it succeeded to raise some red flags, but they always told him that they couldn't do anything and that he needed to wait till Monday. From their point of view, you can be the impersonator so they didn't told us they did anything.
He also sent an email to the local bank manager during the night.
Stressful week-end lock-out of all bank accounts information goes by. The bank app is kind of deceitful because sometimes when it doesn't succeed in connecting shows you the last available data like it would in off-line mode and you think you are connected OK but you are not.
Monday they could reach the bank have the hack acknowledged and investigated ; access to accounts restored and password changed ; no harm done (except for the inconvenience of not having a credit card during the holiday, and info leaked) ; Luck.