Not surprising that they discovered it, even if they weren’t aware of it - I’m guessing this is how it went: person tried to use his card number on some random website, but it kept telling him that his number is invalid. They scratch their head and double, triple check that number and then do a google search.