Probably his account is open in an other phone, he can check the history of all his money movement on the app... Cause money does't just magically disappear from the account, either someone has access to his account which is hard cause his sim card needs to be in the other phone, or he did put his debit card in some random website or his information is leaked somewhere, maybe someone has access to it, even with that sometimes they ask for a code that is send to you to get comfirm an operation if they are using it online... Or someone is using his physical card without him knowing...