If you tell them all passwords and OTP, then it is very hard to get money back. I think keeping all money online is risky due to lots of hacking tools available in the market. There are lots of cyber attacks we see nowadays because hackers are somewhat more advanced in some fields than developers.
This is a far fetched assumption, but might happen. If you give them all the details such as USER ID, password, car details among other things then this can happen. Although if you are released later then you can file a complaint against the accused and you might also be able to recover the lost money.
It is all possible. However, no incident like the one you described has come to my knowledge. But stealing money online with the help of OTP and other illegal practices are common these days. It is better to keep this information secret and never tell a scammer if it happens!