[US] My friend had $2,000 withdrawn from his bank account and I can’t understand how they did it.

A friend of mine recently cashed in part of his inhertiance. Within hours of it hitting his bank account, there was an atm withdraw using Apple for $2,000. He said he just got a new card a few weeks ago. What I can’t wrap my mind around is how did someone pull cash out of his account without his pin? And if they used Apple to withdraw the money, wouldn’t a code have to be sent to his phone to even add the card to their wallet? This whole situation is just confusing. Luckily, after helping him fight with the bank for hours, they are returning his funds, but that still doesn’t make me any more comfortable with the situation. I just don’t understand how any of it is possible.