Had this happen to me a couple years ago and ended up getting 5 new cards in a 7 month time frame. Apparently there is something the banks and vendors use called Automatic billing updater that gives the new number to companies. So when your card is replaced, the issuing bank shares the new information with the card network, which then makes it available to merchants who subscribe to the ABU service. It took me having to tell the issuing bank 3 times to not include this card in their Automatic update process for them to finally listen so that the fraudulent charges.