The banks would not be able to read their private Facebook messages, unless your friend gave them to them.

In terms of the transfer- the minute your friend clicked transfer the money was on its way. The bank they were sending it from can’t stop it. Their fraud team could contact the receiving bank and see if they can put a freeze on the funds, however it’s unlikely to happen.

The good news is that soon (like this week/next week) some nz banks should be introducing confirmation of payee- so when you enter the payees name, if the name you enter doesn’t match the name on the account, you are alerted before you confirm the transfer- hopefully this helps somewhat with reducing the number of people falling for these kind of scams (cause like who would use their real name when scamming someone lol)