Re: Been there, done that, got the paperwork!
I had this very thing happen to me last year. i.e. someone try to pay a Barclaycard debt using money from my account. NatWest refunded the money the same day (within the hour actually). No password change and I don't have their app installed on my phone. Well, how could I when said phone is a Nokia 6310????
no 'stranger' online access to my account either.
The silly thing is that by paying a BarclayCard, you know who is getting the money. Perhaps it is an attempy to blacken the BC oenwers name?
It might have been a error in a payment setup. All it takes is one digit on the account number? I don't know but I got the money back without question.
YMMV (and probably will)