So going by what was said they are registering as you on the banking app on a different phone as they have your card and any OTP sent to your sim. Then viewing your pin.
Starling would be immune to them even registering on a new phone in the first place. Not sure how it works with other banks. Credit cards are clearly a different matter.
To view you pin with Barclaycard you only need a 5 digit pin you probably set up when you registered on the app and a Virgin money credit card only needs the three digit number on the back of the card. Well there’s your problem then 
eSims will also help in preventing this fraud as they can’t take the sim and in one case they swapped a guy’s SIM with a PAYG SIM delaying him noticing anything was wrong.
If you have a normal SIM set a pin code. Most people don’t. Also change your settings so content in notifications is not shown until you unlock the phone.