I think there are online vendors who are compromised and they never report the theft of their data out of fear of losing business. I've had two credit cards used for fraudulent purchases at different times, one of which was caught immediately and the other which the CC company made me eat of all outcomes. Either that or there are insider thefts at online retailers and meatspace retailers as well. Pretty easy to photograph both sides of a credit card quickly if you have access to one at your place of employment.
I still remember the time that a woman at my credit card company called me up to confirm that I actually wanted to purchase $600 worth of sneakers. I didn't! Some companies will apparently look at what you've spent in the past to try and verify that future orders are legitimate, which is both kind of scary and kind of nice of them.