To add on, it sounds like you were phished. No shame, it happens to everyone. The best course of action when you get an email like that, DONT click the easy to press recover account button in the email. Always go directly to the site, even if the email looks legit.
From there you entered your password into, what im assuming, was a fake Macys website, where you gave the bad actors the exact info they needed to really activate it.
To add on, it sounds like you were phished. No shame, it happens to everyone. The best course of action when you get an email like that, DONT click the easy to press recover account button in the email. Always go directly to the site, even if the email looks legit.
From there you entered your password into, what im assuming, was a fake Macys website, where you gave the bad actors the exact info they needed to really activate it.