All of those measures to ensure your account is safe are just precautionary and nothing absolute for two reasons. Its either the hackers are smart enough to intercept whatever verification that is being sent to the owners of the account for verification or there is an element of human at the back end who compromise things and because the Company will never publicly admit to such error from their end, they give room for people to carry such activities out. How do I know this, in the bank it is mandatory that every transactions that goes through your account, you get notified via email or text but there is a way the bankers do it that you might be debited or credited and you won't be notified in that case, whatever verification that needs to be done can be deactivated for that purpose alone until the deed is done.