Similar thing happened to me with my credit card - payment made somewhere in Asia which was 'out of my normal spending pattern' (or some such phraseology) and triggered an alert.
When I wondered which site may have been compromised and leaked my details, I was told that the crooks used computers to generate likely credit card numbers then try to make small internet purchases.
If a card number was not rejected by a site, they knew it matched a genuine card and they tried all the possible security codes until they hit the right one.
After a successful purchase they quickly made larger purchases of easily re-sellable items before the card holder became aware of what was going on.
Never needed my actual details at any time!
Used to be worried about details of my spending being retained by the bank but was very glad on this occasion.