The bank only sent me a short message informing me that my credit card was not used normally, so it unilaterally frozen my card and didn't specify which merchants it was in advance.

Banking supervision does have rules:

Article 52 A card-issuing bank shall establish a risk management system for credit card business. When the issuing bank learns from the public security organs, judicial organs, cardholders themselves, relatives, transaction monitoring or other channels that cardholders have risk information such as stolen identity documents, deteriorating family financial status, declining repayment ability, invalid reserved contact information, deteriorating credit status, abnormal card use behavior, etc., it should immediately stop operations that may expand credit risk, such as increasing credit limit, authorizing card service exceeding credit limit, and authorizing business by stages, and take measures such as improving transaction monitoring and reducing credit limit.

However, when it comes to specific business, you should explain clearly to the customer why you want to freeze it, and you can't directly invoke the regulations of the banking supervision.

For an inappropriate example, the criminal law also stipulates that you can go to jail or be shot, but you can't be shot directly or sentenced to jail when the court decides. People ask why, and the court says there are provisions in the criminal law ... which is definitely impossible.

The bank is a service industry, and its behavior involves consumers, so it must be explained clearly.