Cyber criminals didn't hack his bank account, what they did was phone him pretending to be the bank telling him money had been transferred out of his account. That should have been a redflag. The hackers might also have gained access to his computer, usually by a phishing email or a malicious weblink. Use a separate email account for registering for a bank account and use a separate phone of 2FA. And never ever give out information to someone calling up pretending to be the bank and asking for your account details and security questions.
At what point do they say that? Are those your assumptions? The bank might have failed to provide proper controls to secure the account. As example, 2FA is not common for banks in Canada. If the client's computer was compromised, 2FA should have secured the access to the account.