If it's a Visa based card, when you get it changed, you might need to tell them to also rescind all V-something or other. I forget what it's called, but basically if you use it, it's like a saved chache thing where it's previously authorized automatic approval—like a login cookie kind of, but for purchases? I don't even remember now if this is something specific to online purchases or not.
I tried to look it up but I can't find it. Other cards may have something similar. Anyway it's some thing that allows your card to be processed faster at a place you've previously used it, like a prior authorization, and if someone gets ahold of that, they can use it to make purchases without even having the new card number.
Had that happen to me, that's what it took to prevent further theft attempts (hadn't even used the new card after a fraud attempt when another had been attempted). This was a bank-issued credit card though, not sure if that matters or if it would also apply to a non-bank issued credit card. Though it might have been my bank-issued debit card (which is also Visa).
Just, ask about it, maybe they'll know what I'm talking about. Or maybe someone else here will know what I am talking about. It's a thing though.