This looks like an easy thing for Walmart to prevent if they bothered. On Amazon if you add a new shipping address, you can't ship to it until you re-verify you

This looks like an easy thing for Walmart to prevent if they bothered. On Amazon if you add a new shipping address, you can't ship to it until you re-verify your credit card CVV. With just that simple check this attack would be blocked (unless they steal the entire CC info of course).