Purchased an item on one day with a virtual account number from Citi (temporary) as I never used the merchant. They cancelled the order next day stating that they reversed the charges. One month later, I had a bunch of charges that appeared on my account using this temporary number I had generated so it does come from them. Whether hacked or fraudulent.