In addition to @gavs82008 ‘s good advice above, please also visit:-
where besides that same advice, you will also read how to consult your Device List and spot unknown devices, or known devices last used at times you don’t recognise, and how to force a logout of all devices.
This last thing is needed because even if you change your password, your breached account, if that is what this is, can continue to be used by whoever breached it, as long as they stay logged on, unless you force them off. After which, they can’t come back, as they don’t know your new password.
The article also covers ways your account could have been breached, and getting in touch with Now to report this, if it looks like fraud.
Set a Payment PIN on your account so that no-one but you can buy memberships on it. Check your bank accounts monthly for any other unexpected payments to Now. That way you can at least nip them in the bud, while you and Now figure out whose fault they are.