Or like in this article, the victim gave access to their phone to the thief - that's 2nd factor authentication broken, and if their password manager is also unlocked (e.g. via Face ID or by coercion to put their password in) that'll give the thief full access to the account.

Of course, they could put in a 24 hour delay as well for larger transactions. But that's a setting that the user should probably engage themselves.

Also don't use Face ID or fingerprints to open up your phone or especially your password manager or 2FA app.