Here's a credit card I rarely use, but bought in twice to Bovada in December 2017:
And while I haven't touched the card since then, look what just popped up:
I didn't make this charge. Notice that it's small -- either as a test charge, or because they know they're more likely to get away with it (more likely the latter).
Bovada itself did not do the stealing, by the way. It's their shady Chinese payment processor.