Fraudsters might obtain your information through phishing or hacking, and some criminals sell card data online on the dark web. The thief doesn't need the physical card since online purchases only require that they know your name, account number and security code.