They can clone a card, it is not as simple as writing down the number, they use a small scanner to get all the info from the magnetic strip on the back.
Daughters got hacked 5 years ago and it took her some 18 months to get her money back.
On the internet they just claim gift and the delivery address of their choosing.