I agree here 100%. This is more likely than anything happening at PV. Spyware is all too easy to install without knowing.
Also, someone might have access to the card(s).
If fraud, then hopefully the card issuer will reimburse.
Good luck @Kenzie, hope your mystery gets solved.