In my experience, it could be almost anywhere - unless you seriously shield your cards. Over the past 30 years I've experienced card fraud 8 times. I strongly suspected where one got hacked, and was almost certain on one other. But mostly it's just like a fart in the wind.
That's the reason I have all online accounts set to notify me of any transaction. $0.01? I want to know about it because that's a card test amount.