[upstatedoc]

So I get an automated call from my credit union saying there may have been some fraudulent activity with my card and to call them immediately. Turns out some a-hole got my check-card number and started ordering shit from Sky Mall, DSW and some website. Almost $600. They blocked the card before I even called them. So I have to wait for a new card and have to fill out some forms to get the funds back if the charges go through. The fraudulent charges are all "pending". My question is how did they get that 3 digit number on the back of the card? A website that I purchased something from had to have been hacked in order to get that info right?