Does every single article about an unauthorized transaction have to meander around conflating it with
theft as if the consumer has suffered the loss, only to finally reveal at the end that since it's
fraud they've been made whole by the bank per regulations? I can't help but feel this type of reporting grossly misinforms people of their actual legal rights. If you're in this situation, the first thing you do is ask the bank nicely over the phone. If that gets you nowhere, the next thing you do is send a formal demand letter.
And sure it would have been a completely different story if this guy had a large amount of cryptocurrency on his phone, just like if he had lots of cash in his wallet. Once a bearer instrument is gone, it's really gone. Which is why it would be a terrible idea to walk around with £18k in your pocket for a night out drinking. But thankfully for him, this is not what he did.