*****ulent Afrihost debit order created on my bank account

We have no services with Afrihost, but a debit order of almost R2600 went off of our account. It could be reversed by the bank, with a fine, but the bank says it is Afrihost that created this direct debit on their side. When querying with Afrihost, the response is: "The signup appears to have been *****ulent as your payment details were used on the account. How this can happen is that the ****mer or *****ulent person already has access to your payment details and signs up for services with us." That is what I have told them from the start. But my question is, how can that happen on their side? Should there not be any checks on their side. With other service providers you need to give proof of residence and bank statements, how could this happen without that?