Given your credit card info, crooks can easily manufacture a card to swipe. And there are lots of ways for them to get your info - hacking into a store's records, a waiter writing the info down when you charge at a restaurant then selling it, skimming at gas station "pay at the pump" machines, etc. Often they will have your info for awhile before they try and use it.
One of the best things about Chase is their very pro-active fraud detection group. Several times they have called me about fraudulent charges long before I would have seen them on my account. Most of the time, they have called me within hours of a bad charge coming through. I don't see normal charges on my accounts for 2-3 days. I've also had them question valid charges that were out of my normal pattern (a lot in one day, large overseas charges, etc.) at the time the vendor swiped my card and made the vendor call in and put me on the phone to verify my identify before they would approve the charge. That fact that they caught the fraudulent charges is no indication that they know you've been hacked, they are just that good at figuring it out from the preauthorization/charge patterns that are coming through.