Standard Bank refuses to protect customer from ********** credit card transaction effected without valid OTP

I have had a dreadful experience with Standard bank after being a loyal customer for over 20 years. On the 11th December 2018 I received an e-mail from a standardbank email address and the email had Standard Bank logo and the UCount rewards logo . The email pertained to redemption of UCount rewards. As per directions of email the attachment was opened and immediately went to a page which was appeared to be from Standard Bank Online banking prompting log -in details. Subsequently I received an SMS from Standard Bank with two OTP numbers which were rejected . Followed by another two SMSes from Standard Bank each with two OTP the second SMS included a transaction of R 28647 . I immediately realised this was a case of ***** and a phishing e-mail ****. I closed the page and rushed to my Standard Bank branch and reported the *****. That amount of money was debited from my credit card Mastercard account which was linked to my online banking accounts. I had to obtain an affidavit and SAPS case number and then contact the Online ***** department of Standard Bank to investigate. Following multiple daily calls I was informed that the money was traced to an FNB account. However FNB had not responded after receiving 3 e-mails from Standard Bank on the 11th, 14th and 18th December. Eventually on the 28th December Mary Tlokwa from Standard Bank online ***** department informed me that FNB were unable to "secure" the money and that I would be held liable for the amount of R28647 . I am appalled by the fact that Standard Bank's online security systems pertaining to SMS es and OTPs are so deeply compromised that money could be **********ly transacted from my accounts without any valid OTP numbers and that they refuse to take responsibility or to protect me as a long-standing client.