When I pay at fast food drive thru, I always try to get them to stick out the credit card reader, but sometimes they're lazy and claim the system will shut down if they stretch the cable. They could very well have their card stealing RFID device behind the window I can't see. I guess I should quit going when they refuse to take out the card reader. All their employees look like criminals.
I'm guessing they could also just take a pic of front and back of the card and google your zip code or they could have their phone's video camera recording and video front and back without you knowing.
Maybe a couple of times when I made a rare online order of plastic model kit from Japan, my cellphone got a text from credit card company asking if legit. At some point, I stopped getting those texts and found out whoever stole my new expiration date credit card took over my credit card online login and turned off all alerts and changed my email address and deleted phone number and I got no alert that was done. Only when I was trying to take back my login did they get serious about verifying my identity via texting my cellphone before letting me put back my legit contact info and me calling their security section to confirm identity. Lame. Maybe it was an insider job.