From personal experience your account being compromised doesn't have to be on line...we had eaten at a new restaurant and paid with a credit card which anyone has access to once it leaves your hands. The next day I got a call from Bank of America about some suspicious charges that appeared on my account that same day totally over $10,000 dollars for purchases all over the country, New York, Las Vegas, etc....one for $5,000, (2) for $1,000, (1) for $1500, etc. Thankfully they had refused to pay them. The smallest and first one charged was for a pair of shoes from a company I never heard of but evidentally it rang a bell with them. They issued me a new card, of course, and put me on a list where my acc't is watched. If I make any large purchases like for car repairs I call them with the amount so they know what to be looking for and will pay it.
Don't know if they ever found out who did it.