I've been hit twice, first time my bank fraud prevention department called and left a message to call back. When I did so, they asked about some activity at an Office Depot in Detroit. Considering I was in Houston, they very quickly cancelled the card and returned the $110 charge that did go through. They tried to hit me for more but I have a fairly low limit on my debit card for that reason. The second time it was an online game purchase to an address in the UK. This was pre-chip. No idea where they got my card info, most likely a skimmer at some sales point I visited.