My dad had one of his cc's used frauduletnly, shortly after he and my mom moved from NJ to VA. They used to have one gas cc, and paid it off every month. my dad was meticulous about paying bills, and had everything in spreadsheets. So one day he realizes he hasn’t seen a bill from said gas company. So he calls. They tell him, oh, Mr. Siamesecat, we sent the bill to the NEW address, the one in Brooklyn you changed your account to, when you added a third card to the account!
He was none too pleased since he hadn’t done that, nor had added a third card, but he was especially displeased that they couldn’t say exactly how or why an additional card had been added to the account! This was about 8 years ago, when gas prices were just starting to rise, and there was already several hundred dollars in unauthorized charges. Since they couldn’t explain to his satisfaction, he cancelled the account then and there. And later on, there were more charges for the stuff you can buy off the bill inserts. He wasn’t responsible for any of the charges, but he also wasn’t happy with their lax security when it came to customer accounts.
My guess is it was an inside job, or someone copied his card # when he bought gas, and was able to use that to add the extra card.