Andy, I am sorry this has happened to you. About three years ago, my eBay, Amazon and bank checking account were all hacked. I caught on quickly, managed to wrest control back with new passwords, and put eveyrthing under 2-factor protection. Luckily I did not lose any money, nor did I have someone purchase stuff and charge it to me. The bank froze my account, and it was a two-month effort to set up a new account and have annuity and SS payments re-routed to the new account. I have a wonderful young woman who is my bank manager, and she was of immense help and support, above and beyond the requirements of her profession. I also had great help from the Chief of IT security at my university who specializes in computer crime. However, I rarely do any online transactions any more.
I also found out that my Facebook account, which I thought I had closed down ten years ago (I was only active for a couple of months, and did not like it), had still been left open by FB. I think this may be to maintain their subscriber count. This account was also breached, but unsuccessfully because FB locked the account. If I want to unlock it and get in, I need to go through a procedure, where they will contact three of my FB friends to verify my identity. I would need to inform these friends about what happened, and they should be prepared to support me when FB sends them an inquiry about my bona fides. I chose not to do this, although I wish FB would delete the account. They are totally unresponsive to enquiries, and have not provided any reason why they refused to delete my account when I closed it down years ago. Leaving inactive accounts on the site is an invitation to hackers to seize them! FB of all people should know that -- but they are callous in their disregard of the welfare of their members.
When you attempt to sign in, FB should give you the option of establishing your identity through friends. That is what it did in my case.
I think the safest way to do financial transactions online is to keep a separate laptop for that purpose. It should be kept switched off, with the plug pulled out of the wall. When you need to do a transaction, you plug it in and connect to the internet, do your stuff, then disconnect from the internet, switch off power and pull the plug so the laptop is not connected to anything any more. This really minimizes your exposure to hackers and it is quite unlike the usual systems which are switched on, and left connected to the Internet continuously. Needless to say, back up everything and store the backup hard drive or SSD separately, in a box somewhere!
If you want to see how scary black hat hacking can be, take a look at this video from Defcon, a hacker convention: