I’m just speculating but maybe they (scammers) filled out a fraudulent activity form on the Apple site on behalf of the victim and then called before an Apple rep did.
2 points
2 points
Wouldn’t they still need to know the username and telephone number then? That seems like something most people would be unable to link.