Fraudulent purchase

[Spacebacon]

So on Tuesday night, I got a text message out of the blue saying "###### is your Shop verification code." Since I wasn't making any purchases, I checked my Shop App and there it showed an order for a Meta Quest 3 512GB through the Meta Store - NA and can see a Shop order number. I also got an order confirmation from Meta with their own, different order number, but no email from Shop. Also an authorized/pending charge on my credit card. 

I've since deleted my card and address fromt the Shop App and added a passkey, which seems to be the only other form of security for the Shop app aside from a text message, which clearly was not enough.

The only way to get support from Shop seems to be online, and only if you have a Shop order confirmation URL, which I don't have because Shop never sent sent one to me for the order I did not place. 

The order was placed using my email, but apparently not under my Meta account, so while I can view the Meta order details, I can't cancel it online.I've reached out to Meta multiple times, but they keep telling me someone will get back within 24-48 hrs. Meanwhile Shop/Meta are continuing the prep to ship out the fraudulent order. 

I have frozen my card, and it looks like I'll have to cancel it if I want to get the charges reversed since there's no avenue to do so with Shop, and Meta is taking too long.

So my questions are:

1. How was anyone able to place this order using my Shop account in the first place?

2. How do I get support from Shop for a fraudulent order that I did not place if they didn't send me a confirmation URL?