I'm fairly certain what happened was that the card info was written down (or skimmed at the ATM in front of Riteway) and sold online. Because all the fraudulent purchases were made online without the chip.
I did get all the charges reversed, but I'll probably be using mostly cash in the future.
