There are several ways this fraud could have occurred. Someone could have called the financial institution and pretended to be one of the account holders and convinced the bank employee to mail a replacement card to another address. However, this is plausible only if the bank employee was incompetent, the bank had horrible fraud prevention procedures, or the person calling was a relative or someone else who might have access to one of the account holder's personal identifying information.
Another possibility is that a card reader was used to compromise one of the legitimate debit cards at some point in the past. The scanned number can be used to create a new card or to purchase items remotely.
In any case, the account holders should immediately notify the bank by telephone and then in writing, sending the notice and any accompanying documentation by certified mail to the address listed on the checking account statement for notices of fraud. It is very important to document that proper notice was given to the correct address within the required 60-day timeframe. Otherwise, the bank can claim that the transactions were not fraudulent.