Today I had about $600US spread across 20 transactions taken from my debit card over the past three days (I notified my bank said they will give me a new card and will refund me)

This particular account I only use to transfer money in and out of to get bonus savings interest; I have never used it to make purchases online, the card has always been left in a draw and never been taken out of the house. I have never entered the card details into any form, nor stored the card details anywhere.

Given I have never entered the card details anywhere to make a transaction, and neither has the previous versions of the card ever been used, how could this have happened? I have never stored the card details anywhere.

Its unlikely the scammer could have enumerated card details (start from `0000-...-0000`; `01/01` for expiry date and `000` for cvv and increment) as they would have also needed to get my billing address correct.