Is the virtual card number single use? I’ve never used one before. If not, maybe another site it was used on just leaked it along with the shipping address. Edit: Oh, that’s basically what you assumed. I tend to reply before I read more than one sentence :)
Is your address tied directly to the virtual card? If it is, terrible idea on the CC company’s part. If it’s not, how did they know it? I’d assume they have a lot more than just the virtual card info.
We had a virtual card number leaked and used. Somehow we received what was ordered. (lemmy.world)
Everything was reported and changed, fairly quickly to our luck. Another charge was denied the next day.