Have you checked that the registered phone number on file is still your actual number? The TAC part is the most puzzling to me because it's effectively a one-use temporary password, so it should be impossible to steal. If PB's security protocols are working, then it should be impossible for even any of its staff to do this because they won't have access to plaintext versions of any customers' passwords. The likeliest explanation is still the simplest, in my opinion. Someone close to you got a hold of your phone during the time the transaction happened and transferred the money. Your problem is that there was such a huge gap in time between when you discovered the theft and when the transaction actually happened. If possible, try to remember what you did during the day of the transaction and whether or not you left your phone with someone.