If you are one of those people who keeps their debit card in their mobile phone case, has a note of their pin on their handset, or only ever uses mobile banking, you may want to rethink your setup after you read the case of Sami Souret*.

On a recent night out the 28-year-old healthcare professional was kind enough to help a man who asked to borrow her phone. Less than six hours later, her ￡9,350 life savings had been spent by him on Apple products in London. And the final indignity: he used her Uber account to take a cab to Stansted airport.

Her story, which could almost be used by schools to teach young people how not to expose themselves to financial risk, started after a Friday night out with friends in London.

While she was waiting for her 5am taxi to come and take her home, she got chatting with a man who asked if he could use her mobile, saying his had stopped working. Having unlocked her iPhone she handed it over. What happened next is a bit of a blur, she says, but it now appears she was distracted by his accomplice. When she turned around, her new friend and her phone had gone – along with her Metro Bank debit card, which she carried in her phone case.

Related: Sim-swap fraud: How your bank account can be emptied by phone

Quite why she didn’t phone the bank immediately to try to cancel the bank card is unclear – alcohol, she admits, had been drunk – but when she woke up she says she called Metro Bank to explain what had happened.

“I was in a bit of an emotional state. My phone had gone and I was panicking,” she says. “I could not pass the telephone bank security as I didn’t know my passwords. Why would I? I never call them as I do all my banking on my mobile, and all the telephone banking passwords are completely different. They said I had to visit the branch.”

What she had forgotten was that lots of her sensitive financial information was in a Notes file on the stolen mobile. Although the pin for the lost Metro Bank debit card wasn’t listed in the file, it did list the pin for another card. The thief must have found the note, and assumed that like most people Souret used the same pin for all her bank cards. She did.

While Souret was trying to get through by phone to Metro, the thief had already made a series of purchases in the nearest Apple store buying up the most expensive items – using chip and pin with her card.

Souret, along with lots of people of her generation, only ever used mobile banking. Without her phone, she didn’t have the passwords to log in from a laptop.

By late morning, she had raced to Metro’s Wimbledon branch inan effort to cancel the card and get a replacement. By the time the card was finally blocked the thief was just making his final Apple purchase.