They got her new card and activated it, so they set the pin. I wish I had details because it seemed very sophisticated. So she couldn't have been the only one hit by the scam.
Yikes... That's an interesting angle. Not sure how you would intercept both, I would assume/hope they would be sent separately preferably using different methods