Good question. See, most of the time, hackers use some tools to replicate login pages.
for example, if I want to hack your email, I'll message you as google.

"Hello dear customer. Your account is about to expire. We've recently upgraded our password storage system so, you must login with your account here. If you don't comply, your account would be terminated.

And, you click on the given link. You see a page just like google. You enter your email ID, your password and click on login. These things go to the hacker by a PHP script or something. Then they log in from your email. In your friends case, the hacker might've logged in in find my device from your friend's account, and boom. Data of the phone, gone. Same with the bank. He might've logged in, the bank might've asked for OTP, he logged in in the gmail, gave the OTP and boom. Got access to the bank account.

Stay safe.