Most likely the card was compromised from an online store weeks or months before hand. Cards that are stolen at brick and mortar stores have the CVV value from

Most likely the card was compromised from an online store weeks or months before hand. Cards that are stolen at brick and mortar stores have the CVV value from the magnetic strip and are more valuable than those stolen from online databases. Those are re-encoded and typically used at gas station pumps or other stores that haven't switched to chips. Cards stolen online typically come with the CVV2 and billing data that makes online fraud easier. At one time the Secret Service would analyze patterns in purchases to identify which merchants had been compromised. They wouod identify large databases of cards that had been compromised and would turn that information over to the card issuing bank. Given the cost of reusing the cards most banks would chose to mark the cards for additional surveillance instead of re-issuing the cards. At a conference one bank executive said that 20% of cards in the portfolio were marked this way. The net is that if you carry five cards it's probably that one is in the hands of a fraudster already.