Has she reported the fraudulent activities to her bank?

I agree that her physical phone was unlikely to be hacked, but her provider account may have been, she fell victim to some other type of scam. The other somewhat common way is through password reuse.

While this isn't identity theft, there are a lot of things on the guide that would be a good idea to follow here to secure her accounts https://www.reddit.com/r/personalfinance/wiki/identity_theft/