TS is not the only victim. I know a guy who lost rm1k over the last weekend. PBB account as well.

Maybe TS might want to pay Michael Chong (MCA) a visit.

On intercepting SMS, it is not so easy especially if TS's phone is always on. If really the TAC was requested may I suggest TS to check the phone number configured or request a TAC now and see whether she receives it.

The TAC generation I believe is via

[Bank database] -> [TAC Server] -> [Telco] -> [User Phone]

Thus possible points of failure are

1) Bank Database -> phone number for TAC changed
-> Another option that can be considered is maybe PBB system has a bug and the transaction has erronously been credited from her account. Ie. Login, Password, TAC all correct, only account number wrong.

2) TAC server -> Make to generate TAC to a different number (dummy message sent to server etc.)

3) Telco -> Tapping into physical systems

4) Phone -> lost