Credit card theft using apple.com

It is not someone close :)

OK.

I still can't understand how someone can attach the card to an account without dual factor authentication with a phone number.

As I've said before: I'm guessing because your dad doesn't have an Apple ID.

I mean to say that the evil person is aware. And that persoon links your father's credit card to his/her Apple ID and in doing so to his/her trusted phone number.

Also, cannot understand why apple do not give me a way to report this. After all, it is their motivation also to find and block this person (and I guess they can very easily find them).

Apple does not know that the evil person is not the rightful owner of that credit card.

You can contact Apple and inform Apple about it

You do have proof from the bank who that evil person is.

Get more help and assistant from Apple directly, see Contact Apple for support and service -> Contact Apple for support and service – Apple Support (UK) 

My father's credit card was charged for months for thousands of dollard

Contact your bank, they can find out who (name, address & account number) has collected the amount from your bank account, and when.

Depending on your bank, they can collect the amount back within 30 days.

Ask also your bank to block your card, and ask a new card.

Also report to the police.

Provided someone has your card number, they can charge just about anything, anywhere. Dual factor authentication and a phone number protects the Apple account, not the payment method, just like any other storefront.

He has no and never had an apple account at all and have no idea how anyone could have connected his card to their account without dual factor authentocation with a phone number.

I cannot understand how that was skipped.

I'm guessing because your dad doesn't have an Apple ID.

I mean to say that the evil person is aware. And that persoon links your father's credit card to his/her Apple ID and in doing so to his/her trusted phone number.

The bank will let you or your father know who has misused his credit card.

I wouldn't be surprised if it's someone close to him.

Don't forget also report to the police.

No. The requirement to log into your card issuer's authentication screen is only if you connect a card to your wallet. If you add a payment to an Apple ID, there is no additional check except that the card is valid and that the billing address matches. Regardless, if the credit card number is in the wild, so too may be all other account details.

How that evil person managed to convince the credit card company that he owns the credit card, I don't know.

It seems more like an oversight on the part of the credit card company.

You can also try to appeal to the insurance company for a refund from the credit card company.

Of course that doing dual factor using the phone in the apple account is not very useful,

That certainly makes sense, only in the case of your father, it's because he doesn't have an Apple ID.

When you -> Sign in to your Apple ID account page -> https://appleid.apple.com

Then you will see all your Apple ID details that you have added / linked to your Apple iD.