She's not telling the truth
The truth is that the bank account details CAN easily be used by criminals; they just sell things like insurance policies from reputable companies to punters in a pub, at ultra cheap prices. The crims use the stolen bank account details to set up the direct debit, the insurance company sends out the policy to the unsuspecting punter, the punter pays the crims, and the crims run away and hide. A few days later the insurance company realise it's a fraud and cancel the agreement.
And the names and emails and phone numbers can be easily used to call up the customer and convince them that they're calling from talktalk. And because they're indian call centres, the customer won't suspect a thing - they sound just like talktalk's real call centres.
Now what talk talk should do is let ANYONE leave them without contract penalties and they should start to wind up their indian call centres. No less than that.