Wondering how they got father credit card info

This morning, my dad and I found out that someone had made a payment at midnight at the UK's blackwells.com store using my dad's credit card. My dad has OCD when it comes to clean windows. He is afraid of viruses, etc ... He works as a chief energy technician, he is not a donkey ... He makes each payment through a secure ESET browser, and performs a https certificate ritual about 5 times before filling in the bank details.
He called the bank and it immediately blocked the card. How the **** can you shop securely online if someone like him fails?
He is using only terminals like PayU or GoPay...

Why do you imagine it was stolen on-line?, doesn't he ever use it in shops?.

A friend of my wife and her husband went to New York, and took their adult son with them. While they were there the son's card was cloned - as it happens he only use dit in one place, a restaurant where he took his parents for a meal. The American Police were very happy at this, as they then knew exactly where it had happened, and were able to arrest the culprits.

Advantage of a creedit card of course, they refund your father the money that was stolen.

Same thing happened to my wife - her card was used to buy takeaway food in the UK and we are on the opposite side to the planet.

Now she won't use her card at all online.

Nigel Goodwin said:

Why do you imagine it was stolen on-line?, doesn't he ever use it in shops?.

A friend of my wife and her husband went to New York, and took their adult son with them. While they were there the son's card was cloned - as it happens he only use dit in one place, a restaurant where he took his parents for a meal. The American Police were very happy at this, as they then knew exactly where it had happened, and were able to arrest the culprits.

Advantage of a creedit card of course, they refund your father the money that was stolen.

Click to expand...

He never pay with credit card in local shops. He use it only to withdraw money at post office...

It can even be random number attempts; one of mine was used some years back in an attempted online purchase, then a couple of weeks later a friend of a relative mentioned they had a similar event - same bank, same first eight digits on the card.

The algorithm for checking a bank account or card number is [possibly] correct, the equivalent of the CRC in the numbers, is public, so it is possible to generate sequences of numbers in the range a particular bank uses then try them until one is found that works.

It's a lot harder now with the extra verification code on the card & possible bank verification checks, but there are still many places that do not use that system.