Nedbank app security alarm

Often we use the banks to guard our hard earned money but that is not the case at all. I was ****med by the post office link bait ****. A friend of mine bought something online and he was requested to pay up R4.99 for his parcel to be sent to post office. His capitec card refused to do the transaction so he asked me to do it for him. After clicking the link the post office page was looking legit little did I noticed its a cloned site. I proceed to fill up my details and even received a bank notification saying I am about to make a R4.99 transaction and I approved. It happened on a Saturday late when I received a bank SMS and an email informing me that my card is blocked for ***** suspicion. I called the ***** line and spoke to a lady who never opened a case instead advised me to go the brand only to be told that they don't deal with ***** I need to call the ***** line of which I did and only she made a case number/reference. The friend who sent me the link buys online things and they get delivered in my house so its hard to suspect him. I received a call from the bank and the polite lady I spoke to me that I will have to wait for 4 weeks but its highly unlikely that I will get my money back. The ****med me R2634 and I do a R3000 rand grocery. This was my grocery money and this month my kids don't even have lunch at school. The lady explained to me and said it was my approval that allowed the ****mers to take the money. My question is I only approved R4.99, so why am I ****med R2634? hackers are all over the internet ****ming people but I trusted the bank to send me a notification that there is a requested amount that needs my approval even if they got card details but the account is linked to my device for a final approval. How did the hackers bridged that? and why waiting 4 weeks , how am i surviving without food all this time?