Apologies, misread your earlier post.
For someone to be able to load your credit card details into Apple Pay on their phone, they need to have your two factor authentication code. If you can’t remember where you may have handed over your credit card details, you might remember if anyone asked you for your two factor verification code. This could have been someone you spoke to on the mobile saying it needed to be given to verify who you were. Once someone has the two factor authentication code, they can activate the card in Apple Pay and go on a spending spree with limited traceability.
If you gave out your two factor authentication code, then this might be why the transactions weren’t considered unauthorised.
