*Disclaimer I’m not a expert this is just some precautionary measures I would take if I was in your position.*
First thing I would do is change all my passwords (most important my Apple ID password and email passwords) and store them on a computer and not my phone. I’m talking everything, Facebook, instagram, apple, PayPal, Venmo, Cashapp, websites etc. then I would make a brand new email with no connection to my old one.
I would also make sure to remove my old email from any and all accounts/apps/websites as they can be used to approve password changes and new sign ins.
I may even create a whole new Apple ID if I feel the security risk of my old ID is bad enough. Make sure I log out of all open sessions I have on Facebook, google, yahoo etc.
Also double check if I still accidentally had any old phones logged into my Apple ID by checking the “Find My” app under my devices or any old phone numbers used for iMessage in my iPhone iCloud settings.
I may even call my cellular provider to make sure my calls or texts have not been getting forwarded to another number without my knowledge.
I would remove any Face ID’s used to approve sign in (both to unlock the phone as well as approve sign ins into apps and websites). Instead use a 6 digit passcode. Adding two factor identification can help as well.
Then I would contact my banking institutions fraud departments to let them know about money being moved without my permission as well as charges that I did not place. I would ask for new cards to be sent to me and change all my pins. While I wait I would freeze my current cards only unfreezing to use them and re-freezing after I’m finished. If possible ask them to set up text alerts whenever any transaction is made.
Im sorry this is happening to you. I hope things get better! 🙏🏻