It's all social engineering
now but that's because phones are secure and remote attestation infrastructure is in place.
Go back fifteen years and malware is absolutely submitting bank transactions after the user does a 2FA.
https://krebsonsecurity.com/2010/03/crooks-crank-up-volume-o...