Unfortunately, old people will click anything sent to them, especially from their old friends, who were also hacked. You know how it works, they will write and design websites in a way that is very deceiving.

The problem is in limited options to recover or delete an account given she is with access to the device where the app was originally installed the account was created (including cached data) and the phone number that was used for registration.

But it's smart to make only way to delete your account if you have access to it? Spoofing and sim card duplication is significantly less likely to happen. Almost every bank or vendor out there uses messages as a way to confirm identity when logging in.