You asked a few questions:
How is this possible?
Unfortunately, that's the hardest one to answer, because none of us know the exact mechanism that was exploited here - and you will likely never find out. Although, we can make some guesses (see below).
Is there a delay until a new card shows up on credit reports?
Yes. Card issuers generally submit data to credit bureaus on a monthly basis. So, it's possible for an account (legitimate or otherwise) to not show up on your credit report for some time. On the flip side though, generally, hard credit report pulls (i.e. to obtain a new account) show up much more quickly - when you apply for and get a new credit card, it's typical for the hard pull the lender made to show up quickly, while the account itself may be delayed a few days or weeks. In some cases, I've seen new accounts not show up on a consumer's report for nearly two months. I don't know the processes at those issuers so I can't comment as to why, but it's certainly possible for there to be a delay.
If not, why would someone associate another credit card with my son's shopping account, and use our billing address?
As a way to hide the paper trail. In the same way that money laundering washes cash, stealing online accounts and/or address data can wash your online transaction history of any association with you. Fraudsters know that certain transactions require certain types of authentication - for instance, associating an account with the correct zip code. If they use their own data, or completely fake data, they won't pass those check points. By using a known-good data point, they can skirt those checks. Stealing an active online account is a common way to get access to known-good data.
This may lead to an obvious follow up question: but the scammer had the items mailed somewhere, doesn't that shipping address leave a paper trail? Perhaps. If the scammer was stupid enough to literally mail the items to their own home address, we can hope that they would quickly be caught. But they may be using a "stolen" shipping address as well (having the items delivered to a house no one lives at, and then grabbing them once they arrive). Or, the entire transaction may be a throwaway - the scammer may be testing the merchant's controls, and they may not actually care where the items go.
The scam may even go much deeper than that - Walmart and other large retailers offer online sales for third parties, and sometimes the scam involves (or is run by) a fraudulent third party - for instance, a new vendor pops up that sells dietary pills, and they get their goods sold on behalf of Walmart (or Amazon, etc), and then fake a bunch of sales of those pills using stolen information as a way to launder money or otherwise commit some other scam or fraud.
Would someone steal online accounts to put stolen prepaid cards to use?
Yes. Prepaid cards work a little differently than "normal" cards, in that when you obtain the prepaid card, it has inherent value but no association to any real person or identity. That's one of the reasons why they are a common tool for fraud, there is a window of opportunity to have access to something that is effectively cash-equivalent but also valid for online or remote transactions. For a fraudster, they're kind of the best of both worlds.
All that said, it sounds like you've already guessed the two most likely scenarios. Either someone has made the transaction on a stolen prepaid card that they associated with your son's (also stolen) account. Or someone has stolen your son's identity and opened a new card account and it just hasn't shown up on your credit report yet.
That all leaves you with a question you haven't exactly asked, but which is begging to be answered. What do you do now? Generally, any time there is a fraudulent transaction like this, you should take the following steps:
- Report it to the merchant. Sounds like you've already done this.
- Change any passwords you use online with any account or email or login name associated with the compromised account.
- Monitor your credit report regularly for at least 6 months, to be safe. Services like CreditKarma are good for this, because you can check daily, and some online services will automatically email you any time there is a change (i.e. a new account shows up).
- Report to the appropriate government authorities. @mootmoot mentioned identitytheft.gov in their answer. That's a good starting place for your situation, but more generally speaking, the US government maintains a website which lists all official fraud reporting channels, broken down by type of fraud or scam. It's a really good resource to use when you think something bad has happened but you're not sure where or how to report it.
- If you know the bank(s) involved, report it to those banks. You don't know it in this case, as you've mentioned, and if all you have is the last 4 digits of the card number, there's no way you can determine it. If you'd had the first digits, you'd be able to look up the issuing bank.
Even if you feel that you are safe and no harm has been done to you, it's important to properly report any fraud or scam you're aware of. Criminals often target specific merchants or banks because they believe they understand the controls those specific institutions use well enough to avoid them. Reporting fraud gives the merchant and/or bank information on how they are being targeted, which can be crucial in helping them prevent future victims. Reporting is also important as a way to clear yourself of any involvement in the crime.
