I had it happen with Summit racing about 5 or so years back. They allowed someone claiming to be a relative to change my ship to address. The SOB bought 1 item, had it overnighted and then went on a shopping spree over about 5 days.
He purchased over 8500.00 of big block ford parts. I just happened to look at my account online and saw something was amiss.
Obviously the bank cancelled all the transactions and issued a new card>
I called Summit and they were like, oh no big deal, happens all the time. We have an insurance company that approves all transactions. OK, you didn't notify me that someone changed my ship to address? No. Even Facebook sends an immediate email when any account information is changed. Our security people don't think that's required.
maybe they'd like to compensate me for the BS I know have to go through because they're idiots . HTF did they get access to my account to do so? Uhh we're not sure.
The ship to address was a legitimate house address. I even went so far as to call the local PD in the town (west of St. louis) and left a message to call me as I think I know how the card number was compromised. Nothing, NADA. Still wonder to this day if the J/O got 8500.00 worth of free parts?
The bank then was issuing me new cards every 6 to 12 months (a royal PITA) until recently when I received a new one with an extended expiration date.