I recently had something similar happen to me. Someone used my PayPal debit card to reload my Starbucks card for $150 which they then used IN STORE in Massachusetts (I live in Michigan) to make a purchase for $149.15. I received an email receipt from PayPal and immediately notified them that the purchase was fraudulent. Then I looked at my Starbucks account and realized that I also had my Discover card and Chase Visa card stored in my account. I didn't realize that they were being stored when I did my own reloads so I immediately deleted them. I checked both of the cards and, sure enough, my Discover Card had 4 pending authorizations, 2 for $100 and 2 for $50...all from Starbucks. I called Discover and they cancelled my card and told me that the charges were still pending and would not go through. I also saw a charge on my Chase Visa, but that was also blocked before it could go through.
I called Starbucks and let them know that my card and account had been compromised and unauthorized purchases were made. I also sent them an email and they assured me that no breach had occurred. I politely told them that all three of the cards stored I my account were used to make (or attempt to make) reloads to my Starbucks card. One of them was successful and the thief was able to purchase almost $150 in merchandise (in the store) using the stolen funds. Thankfully, my money has been returned to me, but I no longer have a Starbucks account and I do not have any plans to re-open one either. They assured me that my account was secure despite the fact that I told them that it was breached. A security camera from the store and my time card showing that I was at work and not in Massachusetts at the time of the purchases would be plenty to prove that they were robbed. They didn't seem to care so I let it go...my money is back in my hands so I am all set.