I checked my bank accounts early one morning in 2005 through internet banking and couldn't believe I was $7400 in debt on my credit card. I rang the bank and was informed that I had made purchases in the UK, namely a computer, TV and obviously I hadn't.
The next incident happened more recently in 2018 whereby I had $12000 taken from my credit card for purchases in Japan. Again, it wasn't me.
I am normally very careful when I'm online but obviously I wasn't careful enough. On those two occasions I had not used a VPN, I always believed a good antivirus was all you needed.