THEY TAKE INSTRUCTIONS FROM RANDOM NUMBERS REGARDING YOUR POLICY

I got a mysterious debit from then on a date we never agreed upon. When I inquired about it I was told that they received an SMS to change my debit date, they don't want to confirm where the SMS came from but they confirmed it was not from my number. How can they take instructions from a number that's not on my profile??? I am still awaiting a call regarding an explanation, it's been 4 days now. IT LITERALLY MEANS ANYONE CAN ACCESS YOUR POLICIES WITH NO SECURITY VERIFICATION BEING DONE.