OTP can be sent to any phone number Do not think your money is safe

On 21 July my credit card as well as my bank account was hacked. I received a call from someone telling me that she is from the ***** division of Standard Bank. This person already had my name ID phone number address and card numbers. I immediately phoned the ***** division and the transactions were put on hold pending investigation. The OTP pin numbers for the with drawls made were not sent to my cell number as the person had all my information and the OTP's were just diverted to another phone number to release the payments. The original payments had the description pay.flutterwave.com. Now on 27 July the bank released the money to another party RAVE 4451*6489. How does this differ? I have received no communication from Standard Bank with regard to this issue and my credit card and bank account are now maxed out. The credit card division even allowed the person to withdraw more money than my card limit should have allowed??? Surely the transactions exceeding my credit limit should have been stopped? I have a new bank card that was issued on Friday 24 July and yet the bank forced the transactions on 27 July without any notification or OTP sent to my phone? So now I have to ask why Standard Bank does not have a check in place as they do have your phone number on record to check that the transactions could not be diverted to another phone number to de***** you of your money. Their OTP system is a sham that offers no protection as the perpetrator does not need access to your phone. I would like Standard Bank to prove that the OTP for the ********** transactions were sent to my phone and the payments were made with my consent. Failing that I would like them to return the money taken. I am of the opinion that this was a inside job as the information the person had was just too detailed to be incidental and the pay out by the ***** division knowing that the transactions were ********** just does make sense