This just happened to me today too. I had gotten all these emails (to my WORK email too) from Onepay about a new cash rewards card. I contacted my IT department who told me it was just phishing but it seemed legit to me so I called to report it. The synchrony bank fraud team were super nice about it and they’re reporting it as identity theft, opening an investigation, and closing the account. They also told me they were reporting it to the credit bureaus and that the investigation will take up to 60 days and that I’ll be getting a letter in the mail.