...unless it's off a "secure" internet site?
It has just happened to us again - only worse - before, people have had our card details but ordered internet stuff like downloads.
Now, someone has ordered something tangible to be delivered to a different address, but was able to quote their name with our address and our card security code, and ask for delivery to their name with another address (200 miles away )
I'm suspecting a paypal connection because we've had this with paypal before, I haven't used it for well over a year but did use it again in December and presto, here we go again.