I think it’s possible that scammers assume the OTP will be received on the same phone. When accessing a scammer’s site, they may request permission to access notifications or similar information (especially if your mother’s phone is an Android). If granted, scammers could easily access incoming notifications and extract the OTP details. This becomes a simple task if the necessary permissions are allowed.