What if a fraudster spoofs the bank's telephone number, calls a customer, gains online login and password from the customer and transfers out $2000 in four transactions of $500 in P2P payments? Who is liable?

Look at 1005.2(m). That is an "access device obtained through robbery or fraud." The bank is liable.