They already do that now. People are getting phished for their sms codes. As a side note, my local news just reported a big crime spree of people robbing cashless places. They have the manager log into the clover POS machines and issue refunds into their cards.

Criminals have been high tech for a while now