Sounds like your bank account was hacked. This is from Apple’s White Paper (link is below) on provisioning your card.
>>Adding additional verification
A card issuer can decide whether a credit or debit card requires additional verification. Depending on what’s offered by the card issuer, the user may be able to choose between different options for additional verification, such as a text message, email, customer service call or a method in an approved third-party app to complete the verification. For text messages or email, the user selects from contact information the issuer has on file.
A code is sent, which must be entered into Apple Wallet, Settings or the Apple Watch
app. For customer service or verification using an app, the issuer performs their own communication process.<<
Apple is not a bank. Apple cannot verify a credit or debit card. Apple does not supply the methods to verify data. >>For text messages or email, the user selects from contact information the issuer has on file.<<
If additional verification is required, it’s on the issuing banks part. Your bank triggers the extra verification notification and uses methods it has on file. If an invalid email is associated with your account, the bank added it, a hacker added it or you added it.
Card provisioning security overview - Apple Support