Santander - 80k been stolen from account?

Gentoo365

http://www.theregister.co.uk/2012/03/15/malware_based_mobile_banking_blag/

The first attack involves a combination of online and physical fraud: the crook either runs a phishing expedition or uses malware to obtain a victim’s bank account details and credentials. As well as requesting login details, the fraudster also seeks to obtain the intended victim's name, phone number and other personal information.
Armed with these details the crim impersonates a victim to report the mark's mobile as lost or stolen to the cops. This allows the fraudster to get their hands on a police report.
The criminal then calls the victim to notify them that their mobile phone service will be interrupted for few hours. In the meantime, the criminal visits a mobile service provider’s retail outlet, presenting the police report on the supposedly lost or stolen mobile.
The victim’s SIM card is deactivated by the mobile provider while the criminal gets a new SIM card that receives all incoming calls and OTPs sent to the victim’s phone number.

OTP = One Time Password (or One Time Pad). i.e. a security code that is used once.

The issue is that mobile phones are being used as 'security' by sending security codes to the handset.

However the mobile phone companies do not treat security in the same way as banks. Arguably the banks are relying on a third party (the phone company) as part of their security process, in the same way they rely on the Royal Mail.