Online Payments: My ATM-only card number (not a debit card) was used for a PIN-less debit, and the bank says that shouldn’t be possible—how could this have happened?

Don't worry how. It's the bank's problem, not yours. They would be liable for any PIN-less transaction that were to happen. If they say otherwise challenge them.

If it's a pure ATM card transaction, the HSM would have verified your PIN, ask for logs as proof.