In the dark old days before Apple Pay, where it was common in America to hand your credit/debit card to some rando at a restaurant and have them disappear with it for a few minutes, about once a year my bank would call me to ask if I'd been using my card in some far-off locale:
"Hi! Are you in Tijuana?"
"Not since 1993. Why? What's up?"
"So you didn't just try to buy gasoline at a PEMEX there?"
"Nope, I'm in San Francisco as speak."
"OK, thanks! We'll get a new card out in the mail to you."
That's a pretty low bar for identity theft, but I think it's defensible.
"Hi! Are you in Tijuana?"
"Not since 1993. Why? What's up?"
"So you didn't just try to buy gasoline at a PEMEX there?"
"Nope, I'm in San Francisco as speak."
"OK, thanks! We'll get a new card out in the mail to you."
That's a pretty low bar for identity theft, but I think it's defensible.