Happen to HSBC a fren of mine. Money transferred out without OTP or any authorization. He just got SMS notifying him $$$ charged to be his account in a foreign country. His account is purely savings account and not used for any online transaction. No explanation given by the bank. Heard another customer there got tens of thousands withdrawn as well.

As an IT guy, my advise for commoner is

#1. Download App from playstore only, never download anything through link.
#2. When redirected to bank transfer page by 3rd party, always double check the URL, make sure its legit. Any IT guy with sufficient knowledge can easily clone the same interface to trick people.
#3. Remember your security phase and picture, always double check before login, these are the info that hacker cannot fake which only known by the bank.
#4. NEVER perform any confidential activity through FREE WIFI.
#5. This is my personal habit, deny all access request from the all application, until the moment u wanted to use it, thn it will pop the request again, and that moment u will knew whether the access request making sense anot. e.g. While using camera filter app, it will pop for camera access request, make sense, but if it's asking to access my contacts and SMS, thn that's fishy, why tf a camera app need to access them?

Pure text SMS alone cant do much thing, most likely the victim phone already infected by spyware early on, my guess is the SMS probably is just a trigger.