Uh, I received a call from my credit card company saying that train tickets were bought using my card in Germany. I told them I haven't been in Germany for the last decade, and was issued a new card.

So at least your credit card issuer (presumably) actually has a working fraud department.

In the private sector, fraud detection is often heuristic based. So this was probably flagged because you didn't buy German railway tickets in the recent past and maybe even you didn't buy anything else in or near Germany.

I remember years ago getting a decline on a credit card transaction to pay for one of my ISPs, and then hours later a phone call. My bank apparently didn't understand (yet, this is years ago) that ISPs are like, not necessarily physically nearby and so since the ISP is on another continent and I had no other nearby transactions it was flagged as likely fraud.