Change your password, sign out of shared devices and contact support with the time and type of activity. Do not send passwords or payment credentials. If a bank transaction is involved, contact your bank through its official channel as well.