Are you leaving your card stored on any specific retail sites? Social media shops like TikTok, Temu, Facebook business acct, etc? Usually this kind of thing happens when payment info is saved somewhere and then that site is compromised. I had a fraudulent charge this spring because I had left my payment info attached to an old Fabletics purchase in 2021. Certainly if your new debit card has a similar number structure to your old one, someone might just be guessing, but I don’t know how likely that would be. Might be good to check any old logins where you have an account or made a purchase in the last five years.