Banks do this all the time. They notice fraudulent transactions, call you, or block the transaction outright till they can investigate. The fact that this happened, no one called, no one checked, reduces the faith in the service.