TD didn’t disable pre-authorizations after fraud

I noticed some fraudulent transactions on my Low Interest Credit card listed from Apple. Called the bank. They did the usual. Disable the card. Report the transaction. Etc. well, they didn’t turn off pre-auths on the card. Days later I noticed my card number changed in the app however there was a new transaction from Airlo. I called TD again and asked how this is possible, I hadn’t received my new card. They told me they had an error and the new card wasn’t sent out and that they didn’t disable pre auths from the old card. It was a mistake. I told them to remove the Airlo transaction and they said they would have to investigate it. WHAT??? They didn’t disable the card correctly and now they have to investigate this transaction? Why? It’s their mistake. The transaction would not be there if it were not for their incompetence. Do I have any recourse here? F***ing banks!