Employee at Macy’s swipes the card twice, once on the machine for Macy’s, then they bend down and swipe it a second time on their Square or similar card reader. The number was probably sent out instantly, fed into a list of stolen numbers, and then imprinted onto hotel keys (or dead cards).
The newest trick is to put the information on an empty gift card (lift a whole stack of those from the local market.) If the company asks for ID, you show them it is a gift card, and away you go.
All that said, please make sure that you triple check your bills for the next couple weeks.
...or the person behind you in line takes a pic of your card with their cellphone.
I've noticed of late that cashiers will ask to see my card after I've swiped it at the register. But they don't bother to check the signature. What they do is key in the CVV code. The CVV is three digits printed on the back of the card, except for American Express, which prints four digits on the front of the card.
The CVV is not contained in the swipe data. Thus, a card made by recording stolen swipe data on a dead card will not work at, say, Staples, where they enter the CVV, but will work at a grocery store, where they typically don't. Also, I've noticed some gas pumps now ask you to enter your billing zip, a measure which also defeats cards made from stolen swipes.
I read somewhere that total fraud volume amounts to five or ten basis points. It's a big number, but proportionally, it's tiny. You may recall during the 2012 election that Newt proposed out-sourcing immigration security to the card companies.
That makes sense. Thanks for the info!