Unauthorized transaction at Trade Republic. And how do fraudsters even get around MFA?

Today I was announced a direct debit for tomorrow at Digistore24 via Ulzer. €79.99 wants to be debited. The seller says it was ordered by another name. Support and security experts from TR have been contacted and should respond by tomorrow. Revocation process has been initiated. My main question is... How can such a transaction even be carried out without it having to be confirmed by the h MFA? It wasn't paid by credit card, that means i