Security Risk: Payfast Payment didn't need FNB App Authorisation or OTP

Imagine my shock on receiving an FNB confirmation that a Payfast payment of almost R7k was successful. How was it processed without me authorizing it on my phone, what about OTP? My phone is working perfectly as I logged in and got a notice immediately. So FNB, how was a Payfast payment processed singlehandedly by supplier into my account? So much for world-class security.