Quoting for visibility.
I do not know how to upload images here
[Tutorial] How to add image, resize image and make image clickable
I'm sure Android pop-out notifications are not the root cause of the wallet getting hacked. Another more likely scenario is that your friend are installing an unverified wallet or entering his seed phrase after getting lured to claim on what at the notification message.