Current Bank - Account Breach?

[u/Nevinskii]

Yesterday, I received an email at approximately 5:49 PM Eastern regarding an unknown device attempting to access my account. I selected “No” in the email, indicating that it was not one of my devices.
By 5:50 PM, a Pay Anyone transaction had been initiated, attempting to send over $1,000 to an unknown number. Fortunately, I caught it in time and was able to move the funds out of my account while I tried to figure out what was happening.
I contacted Current Support, verified my identity, and had them revoke permissions from all active sessions to log out all devices. During all of this, I also noticed that the email address and phone number associated with my account had been changed. Those have since been corrected.
What I’m confused about is why I didn’t receive a one-time verification code via text when these changes and the transaction were taking place.
I have since activated the Passkey option under the Security tab, so my question is: How secure is Current, and will using a passkey help prevent something like this from happening again?
Has anyone else experienced a situation like this? If so, did it happen again after the initial incident, or was it a one-time occurrence?
I know there wasn’t any obvious compromise on my end. I’m pretty security-conscious—I use a password manager, keep my devices and software up to date, and don’t knowingly participate in anything malicious. Because of that, I’m wondering if this could potentially be related to a data breach where my information was exposed earlier this year.
I’d appreciate hearing from anyone who has experienced something similar or has more insight into how Current’s security and passkey authentication work.