Its likely your X Phone

Y Phone only receive OTP, so no info to get there to compromise.

OTP is also not a surefire way to validate transactions. Whether 2FA is shown or not, is actually a flag on payment networks, not all payment endpoints need it.


Android gives you that level of granular control of what apps can access.

However, the best bet is still your own discipline and awareness. Sometimes its not even your fault. My card got terminated once without me knowing. The bank called me in the morning to let me know because their fraud detection found it was part of a leak, so they pre-emptively terminated it and re-issue.

If your bank is good, by default it will block on suspicious activity, then you call them to unblock after you verify that the transaction was valid. I used to kena a lot for FB ads charges last time.

However if your card is compromised already, its SOP from the bank to terminate it la. A lot of times, scammers already tokenize the card. Even if you resolve the leak on your end, the card can still be charged. Safest bet is to just get a new card number, which is normally done within a week.