[US] I don’t understand how this happened

A user received a voicemail from a claimed 'WF detection department' about fraudulent charges on their account, which included their real name and last four digits of their checking account. They discovered unauthorized charges totaling nearly $8,000 for 'Microsoft XB' and a $7 charge from 'HCM*TONI PARKHURST INC.' The user primarily uses Apple Pay and has not manually entered card details recently.