Cyber criminals didn't hack his bank account, what they did was phone him pretending to be the bank telling him money had been transferred out of his account. That should have been a redflag. The hackers might also have gained access to his computer, usually by a phishing email or a malicious weblink. Use a separate email account for registering for a bank account and use a separate phone of 2FA. And never ever give out information to someone calling up pretending to be the bank and asking for your account details and security questions.