u/East-Selection-9581

[UK] Need advice/help figuring out what is going on

I bought something on Vinted today and paid securely through the backend of the website (but stupidly used my primary bank card). Didn't share any information with the seller, etc. A couple of hours later, I received a couple of OTPs (62884) and they seem to be from a number that looked reliable (I'd received prior OTPs from them for Hinge). Something immediately felt off though, so I logged onto my bank and found 7 50 pound transactions within a couple of mins that were pending. So obviously my card had been stolen - probably through Vinted but I'm not sure how (I was on a home WiFi network).

I do the usual things people do, which is block my card, report the fraud to my bank, ask my bank to block the scam merchant, change passwords for all my primary emails, my social media, my banks, check for malware/keyloggers on the phone, and cancelled my Vinted order and deleted my account. I'm also generally very cautious and use dummy passwords for unimportant websites, don't carry my primary bank card outdoors and transfer money to a secondary bank account for everyday transactions. I usually also block my primary debit card for all transactions but was lax today after paying on vinted.

I got another OTP a couple of hrs later from the same number. Check banks and nothing dodgy. I am however baffled by what the OTPs were for? They don't look at all like the OTPs my banks send, which have a whole bunch of reliable identifiers. I didn't receive any link to click on or send the OTP to.

I'm also really confused how they managed to setup a card payment because my bank usually asks me to enter an OTP on the app for websites where I haven't previous used my card.

What could be going on here and what could I do to make things safe? I don't have a whole load of money saved up, so I'm pretty terrified. I'm guessing they also got my address, phone number, and name with the card.