same happened to me last month. I had to cancel of course and they told me fruad is huge these days. guys are just making their own cards and applying numbers to them. if at the point of transaction no password is required they’re successful.
I rarely use mine online so it’s impossible to figure out how they did it.