I think all the software the scammers used was in the google play store. I don't think they sideloaded anything.

But I'm not entirely sure. I wasn't there, and she's not tech literate. She was so rattled when I spoke to her about it that it was hard to get a clear story out of her about what happened.