1.
To keep your Apple ID account secure, see the following Apple articles:
Manage and use your Apple ID
Manage and use your Apple ID – Apple Support (UK)
Personal Safety User Guide
Personal Safety User Guide – Apple Support (UK)
If you think your Apple ID has been compromised
If you think your Apple ID has been compromised - Apple Support
See who has access to your device or accounts
See who has access to your iPhone or iPad – Apple Support (UK)
Delete suspicious content from your devices
Delete suspicious content from your devices – Apple Support (UK)
Get a verification code and sign in with two-factor authentication
Get a verification code and sign in with two-factor authentication - Apple Support
Never jailbroken your iPhone.
Change your Apple ID password.
Create a strong password for your Apple ID, It is best if your password consists of eight or more characters and include upper and lowercase letters, and at least one number. You can also add extra characters and punctuation marks to make your password even stronger.
Never provide your password, passcode, security questions, verification codes, recovery key or any other account security details to anyone else. Apple will never ask you for this information.
Then see this Apple article: What to do after you change your Apple ID or password
What to do after you change your Apple ID or password - Apple Support
2.
reported to Apple customer support but they rejected
Refunds are not guaranteed. For more information, see the Terms & Conditions.
If Apple has notified you that it is not eligible then so be it.
3.
Contact your bank, they can find out who (name, address & account number) has collected the amount from your bank account, and when.
Depending on your bank, they can collect the amount back within 30 days.
Ask also your bank to block your card, and ask a new card.
Also report to the police.