“It took less than 30 minutes for these events to transpire.”
Someone changed his Boost Mobile PIN, ported his number to Metro PCS and used the texts to take his email. Then they went after his Coinbase account. Boost’s advice was to pick a better PIN, on a system that offers no account lock. Your bank’s “secure” text code is only as safe as the worst call center employee at your carrier.