Product: Credit card or prepaid card

In XXXX, I applied for and received an Ann Taylor branded MasterCard through Comenity Bank. While this card can be used anywhere, as it is a MasterCard, I use it rarely, keep the balance paid off, and only use it at Ann Taylor stores. 

During XXXX or XXXX of XXXX, someone unknown to me contacted Comenity and was able to have a duplicate MasterCard with the exact same credit card number issued to them in XXXX. 

On XX/XX/XXXX, I received the following text message : Alert : Ann Taylor Pending charge for {$420.00} on XX/XX/XXXX XXXX XXXX at XXXX XXXX XXXXXXXX XXXX for Mastercard card ending in XXXX. For help reply HELP. To stop reply STOP. 

I contacted Comenity immediately to try to put a stop to the charge. I was sitting in my house in Washington State when I received the text. Not in XXXX. Unfortunately, due to horrible customer service issues, by the time I reached the fraud department ( an hour long wait ), the charges had been approved. I filed a formal fraud report with Comenity, advising someone used my account fraudulently. 

I asked how my address could have been changed. They had no answer. To change an address, only a few data points are required, and these are data points anyone can find in many public records. Last four of SSN, name on account and zip code. They do not ask for a secret password or answer to a security question. Comenity does not engage in good security procedures. 

On XX/XX/XXXX, Comenity issued a billing statement to me, advising my balance is {$420.00} and that I need to pay a minimum payment of {$30.00}, due by XX/XX/XXXX. Mind you, my card has had a XXXX balance since the end of XX/XX/XXXX. The balance on the card is the one I reported as fraudulent. Are they allowed to bill me for this? How is this legal? I can prove I haven't been to XXXX and wasn't in XXXX buying gas on the day this charge happened. My employer and my children 's school can also validate I was in the State of Washington in the date of this charge. 

On XX/XX/XXXX my newly reissued, soon to arrive in the mail, MasterCard was unlocked by someone unknown to me, and a digital card was issued. I had not even received the physical copy of the card or activated it. I relocked the card. I changed the password on the account. 

Today, XX/XX/XXXX, I learned I was locked out of the account online. The unknown fraudster had changed the password, and Comenity NEVER fixed the mailing address back to my address, so I was left unable to self service the account. The fraudster simply went online, entered my user name, their zip code ( as Comenity didn't correct it ) and the last four of my SSN, and they were able to change the password. No other security measures were required.

I contacted Comenity immediately, and asked them to close the account. It took four times of asking to get the account closed. Easily, however, with little verification of my identity, I was able to get my address changed back to my address, from the fraudster 's XXXX address. Furthermore, I requested paper statements, as I can not even access the account to pay the bill they are saying I owe. 

Their customer service rep advised I needed to pay the bill and they would refund me after the investigation was over. This doesn't appear to be legal. Also, aren't their newer security requirements for banks and financial institutions requiring deeper levels of security??