AOPA VISA card fraud via XM Radio?

A couple of weeks ago, the bank that issues the AOPA VISA card called me
to inquire about some suspicious charges against my card. I said they
were not legitamate, VISA refused them and canceled the card. They sent
me a new card with a new number, which I received last Monday. Today I
got another call about some *new* suspicious charges on the *new* card
number. Once again, they were fraudulent. Now here's the interesting
part: I have used the new card at only one place: XM Radio. Not on
line, not at a restaurant, not at a gas pump, nowhere else. I had to
call XM Radio to let them know the new card number so my satellite
weather link subscription would continue. It seems to me XM Radio's
billing system must be hacked. Otherwise, how did the thieves get that
new card number and match it with enough information about me to attempt
to charge $300 worth of stuff at Buy.com?
--
Dan
C172RG at BFM