İş Bankası Charged My Card Without SMS Code for Fly Dubai Ticket Purchase

I accidentally used my İş Bankası credit card to purchase a ticket to Turkey through Fly Dubai. Since I didn’t enter the SMS confirmation code sent to my phone, the transaction should have been canceled, and no money should have been withdrawn. However, the amount was still deducted from my account. Not realizing this, I later used my international credit card to buy the same ticket again. As a result, I was charged twice for the same ticket. My bank informed me that they couldn’t refund the amount, while Fly Dubai said they could only provide a partial refund. This situation raises a serious security concern. How was the charge processed without me entering the confirmation code? I am filing a complaint against both companies and request a full refund of the withdrawn amount.