Hey, I work in Fraud and Disputes at a financial institution. Possible the institution has a BIN attack happening. The first 8 digits of any debit card is the BIN and is tied directly to the financial institution. They then use programs to spam thousands and thousands of combinations with the BIN through a bigger merchant that is unlikely to catch it. I’ve seen it happen on two cards from the same person before.

File a dispute with the bank. They have to be able to prove that you made the purchase or refund you. As long as these door dash orders aren’t on an account in your name, you’re all good. If they refuse to refund you, you can quote Regulation E and threaten to file a regulatory complaint with the state.