The credit agency said that thieves have sophisticated computers that do some kind of random number searches until they get a "hit."
That's a pretty clear sign that the person you are talking to doesn't know what they were talking about.
There is a computer program, called "Credit Master," which contains the algorithms for generating legitimate 16-digit credit card numbers for various types of credit cards. It's freely available on the Internet, but it's virtually irrelevent today. It would NOT work with any credit card from the United States, because all it does is generate the card number itself. It cannot generate any of the security devices which are used, so it's useless on U.S. cards.
I last saw Credit Master used about 10 years ago, against a credit union which had
zero security on their cards. The bad guys hit them for over $400,000, but that would not work today. It might work on a few cards issued by small international financial institutions, but I doubt it.
Skimming, however, copies all of the information contained on the magnetic stripe on the back of your credit card, including the basic levels of security information. It will not capture the 3-digit security code printed on the signature space, which is an additional layer of security that requires the person using the card to have the actual card in their physical possession (or know the number).
Skimmed data is usually transferred to stolen credit cards. Those cards have been cancelled, and are worthless, but with the new mag stripe information they become carbon copies of your card. That's how you can have your card in your pocket and some crook can be using it hundreds (or thousands) of miles away.
The merchant defense against skimming is manually entering the last four digits of the number embossed on the front of the card as one step in the authorization process. If the card is a counterfeit, those embossed numbers will not correspond with the mag stripe info, because that info will be from a different card.
disneynutz is correct that the credit card companies don't care about individual transactions or issues with individual accounts. They just charge them back to the merchant and move on. They do, however, have investigators who work primarily on internal problems and large credit card fraud rings.
Law enforcement usually takes a similar approach -- they focus on ring activity, rather than individual transactions which are very difficult to prosecute. The U.S. Secret Service and the U.S. Postal Inspection Service are the two primary federal agencies involved. Local departments may be very active, or not at all active, depending on the size and sophistication of the agency.
Disney security should be interested if there is good reason to believe the transaction occurred at a front desk. They have people trained in credit card fraud investigation, and they do work those cases.