I bought yesterday a flight from an American website. In my country, tickets are too expensive. Therefore, I used a IPVanish VPN to browse the airline website. It appears as if I visited it from New York.
Lower prices, much happiness. However, I paid with credit card and got the flight, but after 6 hours, my card was cloned in the USA and blocked.
I am not sure that my credit card was cloned yesterday. It might have been cloned months ago and by coincidence used yesterday for the first time.
So, I am asking you this question:
I browsed the website and paid all the time through HTTPS. Considering that I was using a VPN, is a "man in the middle" attack possible in this case? Could the data have been sniffed by the VPN provider or by anybody else sniffing the line?
I want to understand whether is it impossible that my credit card data were caught yesterday or there's a small chance.
Please avoid answers like "are you sure the card was cloned?". We are 100% sure the card was cloned. In fact, what's suspicious is not the ticket purchase (which went fine and did not alert the bank), but a POS transaction in USA of 7USD which occurred 5 hours later. Considering i live in Italy it's impossible for me to physical pay with a POS in USA, so the bank blocked the card and i confirm they did good because i never bought anything for 7USD a 4.00AM on the other side of the world.