I've heard plenty of similar stories but, for obvious reasons, the banks tend not to reveal exactly how the trick is worked.
Several years ago I got a phone call from someone who said that they were from Santander and that they wanted to speak to me about unusual activity on one of my cards. I was naturally VERY suspicious but they eventually managed to convince me (genuinely) that they really were from Santander. It turned out that someone had made three cash withdrawals, over the same number of days, from ATMs in Stratford, London, totalling £800. I couldn't work out how they'd done it as
(a) my card was only a 'cash card', rather than a debit card (meaning that I could only use it in ATMs and not to pay for goods in shops or online), so I couldn't have used it anywhere there was a crooked retailer ; and
(b) the card was for my 'emergency account' and had never even left my wallet (yet alone been used in an ATM) in the previous two years!
So the fraudsters clearly have some interesting tricks up their sleeves but it's hard to find out exactly how they achieve their aims.
(BTW, Santander refunded my money remarkably quickly, so they're obviously used to seeing customers money withdrawn without authority).