Capitec fails on security

I bank with Capitec and had registered for online banking and purchasing. in November 2018 they notified their clients of their 'new' feature which allows push notifications prior to checking out online purchases in order to confirm the purchase and amount. I trusted this so called new and secure method. On the 4th of July, i was ****med through a hacker on face book who hacks into legitimate accounts and advertises products. I did a purchase for USD 1.90 , and with no push notification and within seconds, my account was cleaned out. i immediately called Capitec who cancelled my card and issued me with a incident number and i was told i would have feedback within 7 working days. by the 15th of July, i still had no feedback and i called the Capitec helpline again for feedback. I was promised by the agent that i would have feedback within 24 hours. Still no refund and no feedback from Capitec who brag about their security. Not only did i lose my money, but Capitec also charged me a further R60 for a new card. So why does Capitec openly acknowledge that their online shopping is now safer with push notifications etc yet fail to take responsibility when their system failed me? This is a debit card and surely, a pin is needed before authorizing payments????