Product: Credit card or prepaid card

Dear Consumer Financial Protection Bureau, I am writing to you to ask about a situation I encountered recently that just doesnt seem right. Part of what happened involved fraudulent use of one of my credit cards, which is why I am contacting CFPB. ( The remainder of this situation appears to require me to contact a different bureau or agency. ) My concern is not about getting any form of financial reimbursement, as the credit card company removed the charge when I contacted them to report the fraud. My concern is about how this situation could have happened to begin with. If what happened to me isnt already illegal, I dont understand why. 

Heres what happened : Last XX/XX/XXXX, I received an email notification from XXXX XXXX ( now part of XXXX ) that a renewal order had been placed for one URL that I have registered with them, out of several URLs I have. The order was for {$44.00}. I didnt place that order. 

So, I logged into my XXXX XXXX  account and discovered that, indeed, an order had been placed on XX/XX/XXXX, to renew one account and that the order had been secured with a Discover credit card account that was mine, but that had been expired for 5 months at the time of fraudulent use. 

I contacted the Fraud Department at Discover on XX/XX/XXXX to explain what I thought had happened : That most likely, I was one of the millions of people affected by the massive data breech Discovery had recently experienced, and that the small charge on my credit card was a phishing attempt to see if anyone noticed. The rep I spoke with at Discover was XXXX. 

Later, in my extremely frustrating contacts with XXXX XXXX ( I lost the URL through what I believe to be very questionable business practices that I am also in the process of reporting ), XXXX XXXX tried to tell me that it was common for a company to use an expired card to process an order. I was flat out taken aback. I could see it if we were talking about a difference of a few days, one of those situations where a charge was made on the last couple of days a card was valid, and the charge was over the weekend, etc. but FIVE months? 

So these are my questions to you : 1 How can it be legal for a company to use a credit card to secure a purchase when that card has been expired for 5 months? If I walked into a store and tried to use that card, that card would be declined. Why is the use of this same card over the internet different? 

It seems to me that this kind of situation should be managed through financial regulatory agencies at a national level and not through an individual companys business policies or practices. XXXX XXXX   should never have been able to confirm that transaction through Discover. 

2 It appears the fraudulent URL order was placed online. How did the person placing the order get the security code? I had the expired physical card in my possession. According to Discover there had been no charges made on that card since XX/XX/XXXX. 

I do some online purchasing, but not a whole lot, and I dont do any banking or paying of bills online. 

I would really like to hear back from someone about what happened to me as I wonder how many other people this happens to, and how this risk can be controlled. 

Sincerely, XXXX XXXX XXXX