I would say pin lock on the device would render such an attack very unlikely until I read he claimed the device was pin locked?
Maybe it was simple to guess , or something else going on?
I should congratulate the thieves on accessing his Barclays account though. I was a customer of Barclays for many years but simply got fed up of constant technical errors preventing me from accessing my own funds.
I guess they got double lucky in this regard?