They say it doesn't happen to mobile, but I'm not sure what happens if you root your phone and/or install allow apk install from "untrusted" sources in the Dev Opts.

This kind of scam is old, but there are many, like local DNS redirect, keylogging / input-logging, maybe even a piracy web-browser.