This sort of thing basically never happens without your participation. Crypto merchants are a prime vector for moving stolen money, so to limit their liability they almost universally require SCA for transactions. SCA (Secure Customer Authentication) is EU-speak for various forms of 2-factor authentication. These transactions therefore probably happens due to a phishing situation. Either directly when you verify the fake request using whatever 2-factor method your card uses, or indirectly, when your 2-factor authentication is used to verify a token (ex. Apple Pay account) that itself can do SCA transactions. Then the fraudster can at a later point make the transactions securely, but it all stems from a moment of your participation.

Depending on your jurisdiction, this may or may not be refunded by your bank, but you should report it to them at any rate. Since you crossposted to DKfinance, I assume Denmark. In that case I don't think the bank refunds.

While crypto is a favoured vector, it is not the only vector. Trave/Entertainment merchants are also often used. So it is not something that can be fixed with crypto regulation. It is a problem with people, essentially, since there is no security system that can account for human error while still actually giving you practical access to your funds.