Not to add to the paranoia, but the company I work for sometimes receives orders that are placed using stolen credit card numbers (which we cancel and attempt to inform the credit card holder). We do not store credit card info (we don't even see it, it's authorized off site). We do check out suspicious orders and patterns often emerge (same or similar "send to" address, same or similar email address with different billing addresses, etc). One person who was almost scammed had dined @ a NYC restaurant, used the credit card, and three months later their card was used in an attempt to buy goods from my company.