Bank/credit card hacked twice. How do I stop this?

My Chase account has been accessed twice now about a month apart. Both times they have changed the Email and physical address assigned to my account and sent themself a new credit card. After the first time I had to change the email associated with my account, change my password, update a challenge password for calling into chase (security questions), shut down my debit account and create an entirely new debit account, and gave my credit card number changed. They also flagged my account as a fraud account for the next 60 days.

None of this stopped the second attempt where they were still able to get in and change my account email and physical address and send themselves a new card. Both times I realized there was an issue because I couldn’t use my cards since they had a new one sent.

The first time they logged into my account I was able to see what device they had used to log into my account. This most recent time there was no log in attempt or new device.

Is there any way to stop this from continually happening? Do I need to change banks? What info could they be using that may have been compromised?

For reference I almost use Apple Pay exclusively when purchasing online and have done almost all banking on my phone and not on a laptop.

Thanks for any help.