Don't know why a two month old post is being dredged up, but the OP never said the BF did this at a store. He didn't specify at all, so could have been over the phone or online, both of which would only required the acct number, password, passcode, or easily guessed security questions (where were you born, mother's maiden name, favorite pet? A BF could easily have that information at hand).