20 years ago, someone stole my credit card information and bought some stuff as me. I'm in Michigan, and they sent a bed and mattress to Florida. I called the store first, asking about the charge. Verified some part of the card number, name the order was under, etc... I asked what address it was sent to. "We can't tell you that. Our privacy policy prevents that".
Me: "So... you're charging what is my credit card, you've verified my identity, you acknowledge this order was placed in my name, and you're happy to take my money, but you won't tell me where 'my' order was sent?"
Sears(!): "Yes, that's correct".
Called the bank... got a 'fraudulent charge' form faxed(!) to me, which I filled out and sent back same day.
