I checked by budget app today and found 91 new transactions to approve. They're all $1 charges for "GOOGLE *YOUTUBE SUPER G.CO/HELPPAY#CA", which looks like some YouTube premium service, but I don't think "SUPER" exists. It looks like
this has happened to other people.
Well, I called it in to void our credit card number. This happened to us two years ago, which seems way too recently. As with last time, there are a jillion ways it could have gotten out to the dark web or directly into the hands of a rando. I paid an electrician and the YMCA by reading by number over the phone, and anyone at those offices hearing the numbers reported back could have copied them down. It could be a leak or someone at the credit card company. It could any of the dozens of businesses that we've paid with this credit card.
There's not a ton I can do, but I think I'm going to stop reading my credit card out over the phone if there's an option to pay by check. The thing is anyone with your account number and routing number can draw from your checking account, but at least there's fewer ways to do that directly on the internet. Financial transaction security is actually incredibly fragile.