Older friend has a basic Samsung Android phone on the One network. Yesterday she got a txt message advising her phone had been breached and One were cutting it off within 2 hours unless she called them. 

So she called 777, and found it was a legit message. They have now barred her number from being able to do anything outbound - can't text, call etc, but can receive. 

The CSR said they won't be enabling it until she confirms the phone has been fully factory reset. Shes fine with that, but cant understand whats caused this. She keeps it updated. Her phone logs showed nothing unusual (calls/SMS).

I had quick look at her phone last night, and she has maybe 3 "external" apps on it, all legit NZ ones (Rewards, TradeMe etc) that I have on my own phone.

She did ask the CSR as to what exactly triggered all this, but the they said they cant say and noone would be able to tell her.

I find that response a bit "bs", they must have a clue as to what it is, or how else would they know there was a problem to start with.

She (and I) would love to know what was picked up and potentially what caused it so she can avoid it in the future.