It happened to me a couple years ago. Luckily, my bank called me before letting a huge charge go through. My number was being used to purchase a $1000 item online. When I went to check out the site they told me, it was all in Arabic writing!
I had been to a store a few days earlier that I rarely visit and had used the card there. The people there, or in the clearinghouse they used, may have copied my number, and sold or passed it on. Who knows?
My bank immediately cancelled my card, and within a couple days, I had a new one in hand. Now they have disposable credit card numbers you can use - you transfer the amount you need to pay to the disposable number, use it once, then toss it. Ask your bank about them. Online, I stick with PayPal. I've only had to register a complaint with them once, but it was resolved quickly.