That's an impressively risky scam for the scamming partners. They have to be able to convince both parties (the user and the bank) that they are real. If anything, it requires the user to pick up the phone when called from an unknown number. AND it still likely requires the users username and password.
It's a clever scam, but probably not efficient enough to be with the effort.