[Wreck_C]

It was a method in the past if your had good account history but it is difficult now. There are aware of the exploit and added more layers to protect themselves.

someone has to know your password and have access to your phone number to approve the transaction if you are using an IP not similar to what you used before. They also compare transaction history for unusual patterns.