What you are worried about may happen. If the other party really wants to use someone else's ID card for card overdraft, it only needs a real ID card. Nothing else is needed.

This is technically well implemented.

As for what happened, the bank finally found out about you, and theoretically you don't have to bear the responsibility. As long as you don't say "you offered it to each other". Because you have too much evidence to prove that you are not overdrawn. Because you haven't applied for a card, it's even more impossible to overdraw. On the other hand, you can hold the bank responsible for lax audit and compensate your credit loss.