Allowed ********** transaction to take place

I received an SMS at 05:40 on 27 November 2017 informing me that a transaction of R5107 had occurred on my account and if it wasn't me, I should call them. I called and they told me that it was a ********** transaction and that they cannot do anything except open a ***** case, although the transaction had not cleared yet. They did however manage to decline 2 other ********** transactions which occurred after the initial one. I called and asked about OTPs but was told by Nhlanhla that an OTP is only sent for online transactions. What measures does Virgin Money have in place to stop ***** from occurring? How come it allowed the initial transaction and not the other 2? Why can't I get an OTP for each and every transaction that occurs on my account?