Hi
When someone requests to add a payment card to Apple Pay on a device, Apple sends that request, along with certain information (including about the device), to the card issuer.
The card issuer then decides whether or not to approve adding the card. An issuer may choose to authenticate the cardholder's identity before approving the request, but it is up to them whether and how they do this. Methods may include, for example, sending a verification code via text message to a phone number that the issuer has on file for you.
Whether or not the issuer chooses to authenticate your identity, a card cannot be added to Apple Pay without the bank approving the request.
This issue is therefore between you and your bank. You may wish to ask your bank what security checks, if any, they carried out when approving the addition of your card to the device that was used for making the payments.
You may also wish to follow the steps suggested here, in case your Apple ID has been compromised:
If you think your Apple ID has been compromised - Apple Support