Allows unauthorised charge on virtual card

I bought something online, realized no goods were coming, and raised a dispute with FNB (Still waiting for feedback as their turn around time is 30 days) Two weeks later, another unauthorised transaction hit my account. I didn't log in, approve, or get notified. Worse, it was on my virtual card where CVV changes automatically—how did the supplier pull this off?

FNB's security is a joke: disputes drag on and virtual cards aren't safe.