CHEWY.COM, CIMB Bank : Two Unauthorized Transactions on CHEWY.COM Internet

On 8 Aug 2018, I received a text message from my Bank saying that RM50.24 (Ringgit Malaysia) was charged to my Debit Card at CHEWY.COM. I called the Bank to report and cancel the transaction. The bank required me to go to a physical branch to fill in a form and wait for about 2 weeks for the money to come back. They also advised me to replace my card. I thought that was too much trouble as I had just barely gotten a new one. 

On 12 Aug 2018, I got a text message from the bank again, telling me that RM35.98 was charged to my Debit Card, also at CHEWY.COM. I called and reported the unauthorized transaction, and complied this time when I was advised to cancel my debit card and replace with a new one at a bank branch, as well as filling in a form to cancel the transaction. 

I usually keep my card in a secure place and barely ever bought things online except for paying phone bills and using the ride-hailing app e-payment. I never heard of CHEWY.COM, let alone bought anything on it. I asked my bank if they could ask me for authorization for every transaction like how they did two minutes after I got charged by CHEWY.COM for the first time--I also got two messages with One-Time Passwords for a transaction of MXN2582 at Paypal Checkout--which transactions didn't go through because whoever was making this fraud would not have the One-Time Passwords required for the transactions. 

The first CHEWY.COM unauthorised transaction was my first ever unauthorised transaction. How would anyone get a hold of my debit card information? They told me that the reason I wasn't sent an OTP for the CHEWY.COM transaction was because the merchant didn't require it. Perhaps they could look into this problem. I emailed my Bank, telling them about this problem. Instead of having me spend so much time calling and going to the bank for every unauthorised transaction, perhaps they could just give users the option to require OTPs for every online debit card transaction. But the customer service reps over the phone and email sounded like they couldn't do anything about it.  

Now I have to go to the bank and settle another unauthorized transaction of RM35.98 (not a big amount, but still have to get it back), as well as get a debit card replacement.

The bank security is questionable. And I do not know how anyone got hold of my debit card information.