Scam Apple Tech Support - phone number came from Safari search

A friend used Safari on her iPhone to search for an Apple Customer Service phone number becuase her bank account had been frozen. The bank indicated there was an attempted data breach and she should have her phone scanned for viruses. The search returned this phone number: * *** ***-****. Upon calling, a man answered the phone, "Tech Support", asked to install Anydesk app and proceeded to indicate that her iphone was in fact infected. The Scammers asked her to sign onto bank accounts, Vemno, and Zelle to check for bad transactions as they were viewing with Anydesk app. They indicated that Vemno and Zelle were in test mode and asked my friend to send test transactions to them. Obviously this was a scam to have her send them money and it was working. They got greedy said that $13000 was being transferred to her bank account and indicated that she should go to the bank and withdrawl that amount in cash while still on the call. She went to the bank, they locked the accounts and assisted my friend in ending the scam call. I believe they would have asked her to wire the money back to them.

Wow, you should never allow anyone to remote to your device and open financial apps etc... I believe that she was frazzled and figured that she called "Apple" so she trusted that the were really helping her to identify malicious transactions. The Vemno transaction failed because the account was locked. The Zelle transactions failed for some other unknown reason and the cash was never withdrawln.

Luckily there wasn't any financial damage but I'm very concerned that her phone is somehow compromised.

The initial search which yeilded the malicious phone number above couldn't be replicated on her phone, her computer, my phone, or my computer using Safari. How was she redirected to this phone number? What can be done to test the integrity of the phone at this point? So far, we wiped the phone and restored from three days prior and checked to see what devices have connections, etc. It's quite possible that the restored data is also compromised. Any help or suggestions would be appreciated. I'm an I/T guy and clearly understand her mistakes so please don't leave sarcastic comments. Thank you in advance for any help you may provide.

[Edited by Moderator]