Not every hack is an actual virus, far from it.
While very handy for malware, trojans, and software exploits, Anti-virus software won't help against a Phishing-style attempt, especially if the same usernames and same or similar passwords are used across multiple websites. It only takes a single slip up and they gotcha.
I work in the cybersecurity industry and I have seen some VERY convincing phishing attempts. To the point, I have had to just trust my gut that what I was looking at was a phish attempt.
Phones are handy, and are also the devil since you can also be Smished (SMS "aka" text hacking). Smishing is very prevalent in Europe (where I currently am working). They use this as a way to verify phone numbers used in two factor authentication or drop malicious links that land you on websites that look legit, but aren't. Think about HOW MUCH information is on your smart phone, meta data in your pictures, etc - should scare you a bit.
Use two factor authentication where it makes sense and use a Yubikey (hard token) as your second authenticity token. Yes, they even make them that work with phones...two factor is not impervious if the user isn't attune to what he/she is reading!
This link is safe and worth a read if you want some basics:
https://www.trendmicro.com/en_us/what-is/phishing/types-of-phishing.html#whaling-tm-anchor.
Don't take a knife to a gunfight!