I, too, had this problem this Christmas, but where I was hacked was never found out (or, at least, not shared with me or the bank). My personal banker made a creative suggestion since I am not a paypal user due to some problems several years ago. They set me up with TWO checking accounts and labeled one of them as my "Shopping" account. It will remain at zero balance until I transfer $$ into it when I am ready to shop online.
I go to a site to order, determine how much the charge will be for my total purchase, move to my online banking site where I transfer the correct funds into the "shopping" account, go back into the ordering site and complete the transaction with them using a DEBIT card that only works on my particular "shopping" account. At that point, when the charge goes through, my "shopping" account balance at the bank goes back to zero, so it will benefit nobody to try to charge against it illegally.
The process takes a few extra minutes but I feel much safer than I used to.
Jan in VA