How are they doing it?

i'd stop using that site.
a neighbour bought a collector's coin from a tv advert i think, and after that strange transactions appeared on her statement.

My daughter had her card scammed after using a cash machine.
I always check now to make sure there isn't anything unusual about the machine and hide my pin number.

I would stop using the same websites for purchases if you can. This is how they do it, by your routine. Change around a little.

A friend of mine believed her card had been scammed while she was waiting in a shop queue and holding it in her hand! Her account was empty. Don't ask how they do this, I have no idea. Surely the money ends up in an account and that can be traced. I really don't know.

In theory, when card details are entered into a secure payment system, the retailer doesn’t see the security number. They should only see the card number and expiry date. However, some systems are not so secure and at the point your payment goes through all details are visible which means they can be stolen. Check what system is being used by the retailer you suspect and google it, you can find out how secure it is.
On the same but different note, husband and I both have credit cards from a building society which we never use and keep them in the safe (we have them for the benefits). We received multiple calls and texts when my card was used to ask about unusual activity. We thought the calls and texts were scams and ignored them. It wasn’t until we got home and found a message on our answering machine that we called them. Turns out that someone had tried to use both our cards. The fraud officer became a little cagey and it was when we relayed the story to a friend who is a banking compliance manager that we realised that our details had been stolen by someone working at the bank. They were trying to find websites where you are not asked to enter the security number to transfer money abroad.

It’s happened to me too, twice, and definitely as a result of buying online though I can’t pinpoint a particular website. If you can then obviously you should not use that website again. Websites can be hacked, some save your card details automatically, and doubtless it’s possible that an employee of a company you shop from can copy your details down to use or sell on.
This is why I never use a debit card online - better the inconvenience of getting your card replaced than finding your bank account empty.
Your card details can be obtained whilst it’s in your bag, let alone your hand, but you can buy something that looks like a card to put in your purse to stop that.

Thank you to everyone who replied. I do keep my card in an RFID wallet. Certainly never thought using the same websites ( all reputable) would be problematic. Like a previous poster said, I'd rather have the inconvenience of cancelling and waiting on another card than be cleaned out. I appreciate everyone's advice.

Thescam does not have anything to do with you.

Card details are harvested through dishonest employees of the card company or your bank, by hacking and a range of other ways of manipulating datat over which you have no control.

Just relax, use your card normally and but check every statement and report anything on it that you do not recognise.

After having my Credit card fraudently used a few years ago, I got into the habit of checking that account, and that of my current bank account every morning. It is now a part of my breakfast routine and takes a couple of minutes.

At least this way I can pick up (within 24 hours) any fraudelent usage of these cards. Twice, earlier this year, my credit card was cloned, neither times following an on-line usage. One time my daughter had used it to purchase coffee for her and me at a small pop-up roadside place. The second time, I have no idea where it occured.

I find the credit card company extremely good, I contacted them that second time, quite late at night - and they dealt with it very efficiently and were very reassuring.

I really do recommend that people check their accounts pretty often.