They may not have copied your card but used skimmer or other stealth trick.
This old dog is attempting to learn to use GPay on my phone tied to my credit card to try to avoid the skimmers that are becoming so prevalent around here. As little as I understand it, GPay uses some sort of "phony" cc number to anonymize your transactions? Also got a couple of store apps tied to GPay to avoid less than honest cashiers.
Captial One has a similar setup for online transactions. I just started using it. Very easy.
