Alfa bank and strange sms fraud?

Question

SMS

Weird scam.
I decided to pay for my home phone (MGTS) online through alpha-bank. Successfully completed the payment and a few minutes later received an SMS with the following content:
Podtverdite oplatu scheta MGTS for summu 331.00 RUR for nomer 495xxxxx. Password: 36b7x4xr. Alfa-Bank
Where 495xxxxx is the phone number I paid for.
I was somewhat surprised by this way of working and I logged into my personal account (alpha-click, as usual - through a temporary password that comes by SMS after entering the login / password). I did not find any traces of a request to enter the sent password in the interface and decided to call the bank to explain to me where this password actually needs to be entered.
After 10 minutes of waiting, the operator, having heard what was the matter, asked to wait. I listened to “let my people go” in poor quality for another 5 minutes. The second operator also immediately asked to wait and switched to the third operator. I prepared to tell a boring story for the third time, but I didn’t have to - the third operator, picking up the phone, immediately stated that this was a scam and that I should not enter anything anywhere. After a short inquiries, I was not able to find out the answers to my questions:

1. What exactly is the fact of fraud, if I do not lose any money?
   Where should I enter the password and what should happen?
   
2. The connection with the alpha bank took place via the https protocol, but the scammers were able to find out the phone number of MGTS, which I paid for.
   
3. If the attackers found out the phone number that I paid for while I was in a secure connection with the bank, then what prevented them from knowing all my data available at that moment?
   

I did not enter the sent password as a temporary one, but I think if it was generated by attackers, and not by the alpha bank, then it simply would not fit.
Does anyone know what it is?

Answer 1

Fraud for "aunts on the phone" is a catchphrase when they do not know what to do and what to say. That is why they switched operators.

Answer 2

Looks like a Trojan - habrahabr.ru/blogs/infosecurity/113787/

Answer 3

2. There are many ways. For example, DNS spoofing. You simply connect to the server of scammers and give them data. And they are already connected to the Alpha server.
3. Nothing interfered, just any withdrawal of money requires SMS confirmation.

Answer 4

What's the scam?
Is this your first time using click? All payments must be confirmed with a one-time password.
Maybe paranoia, but I was saved once when I almost put 30,000 on my phone instead of 3000.

Answer 5

It is not necessary to exclude the possibility of software failure on the bank's side, which sent SMS twice with a different password. Do I understand correctly that the text is identical except for the password?

Answer 6

I just repeated the procedure, the text of the SMS that came from supposedly malefactors completely coincides with the SMS from the alpha bank for a specific payment operation. It looks like the adbfa-bank really screwed up and sent two sms.