People that have CC information will usually trade them overseas. They will then write out white-cards and proceed to cash-out at the nearest bank machines. Sometimes they will order goods, but that’s too risky. Much easier to go with 20 cards at an ATM in a shady convenience store, pop a grand or 500 from each and leave. Some people make a lot of money out of cash-outs like these.

Of course liability should fall on those companies that do not use enough protection on their systems, physical, digital and otherwise.

So our site which flagged for cc number, expiration date, 3 digit code, billing address & phone number kept haulting the transactions. But the fraudsters kept trying different variations on names and addresses. Ergo J S Smith, John S Smith, Jon Smith.

They would try different combinations for small amounts trying to get a preliminary authorization. If they got an authorization they would put in a large order (several thousand dollars) if it was rejected for limit reasons they would try and scale it down.

What they did not know was that our company would not ship large orders via cc, so we never processed/charged the cards, and we were able to see the trend of what they were doing and turn it over to the NJ police.

The NJ internet police however thought that this particular area of NJ was to dangerous to stake out so nothing ever came of it.

Sounds like the fraudsters in Spain had some but not enough info to put through on the site, and you were protected in part by Chase and in part by the merchant service company and in part maybe by the controls of the online store.

It could also be that your card got copied while you made an offline order. My ex-girlfriend experienced this in Quebec: She purchased something with her card there, and the next week her bank account got emptied.