Control over the phone number means the hacker can intercept the OTP sent via SMS. The attacker accomplishes this by phishing or social engineering. Either way, they trick the victim into installing malware that collects the needed information on the SIM card.