Two points

1) HOW did the hackers get their mobile phone number once they had their card? Was it a dark web purchase based upon their name and address? A mailed CC should just have name and address, no email/phone number should be included in that physical mailing.

2) What are pros/cons of using a virtual phone number like Google Voice or Ooma for these type of financial services? Would that be an improvement? Though I know some do not support non-mobile carrier like GV.