I’m sorry, but I am confident I’d never fall for it. For starters, no decent bank would ring you and ask for details. I would always hang up and ring back.
Also, she had an email from Booking.com to say that a holiday had been booked - why didn’t she check her account to see if the money they had “tried” to take had gone? Surely you’d just check your bank account and see what is there / isn’t there and if the money was still in your account you’d know it wasn’t legit. Jeez... surely she spends enough time sitting around doing nothing to suss this one out. I thought just people with busy and hectic lives would get caught out like this.