The whole thing made me paranoid; how could I have been compromised in such a catastrophic way?
Turns out (perhaps unsurprisingly) the weakest link in the chain was human. A fake ID was used inside a branch to gain access to my accounts. Additional checks that were supposed to be carried out, weren’t.
The bank issued the fraudsters with a new card and PIN number. And that was it. They had everything they needed.
@phill sounds awful 😫. You should name and shame the bank for forcing you to go to the ombudsman to get your money back.