I had to deal with this recently. Basically, they put a hold on the account. The request is forwarded to another internal department for verification. Once verification is complete and the team determines the request is not fraudulent (asking for "verification pin" or "account password"). Then the request is forwarded to the appropriate tech team for further processing.

SMS and calling was blocked during that entire time (~24-36 hrs) since the backend teams are likely operating in offshore timezones.