I was checking my personal email from work yesterday and noticed three emails from Apple
Curious, I opened the first and it stated that my name on my iTunes account had been changed as well as my credit card details. The second that I had changed my card details and the third that I had just purchased an in-app item.
The emails looked legit, but as I was using Webmail did not have the tools available to me that I would normally use to verify links. I signed into my Apple ID online, but it seems accessing iTunes things needed to be done in iTunes.
I got home, checked iTunes and checked my account
At this stage it told me I was locked out and needed to change my password. I did and then checked my account. Sure enough my stored credit card was not a card I recognised and my last purchase was on the 17th. Checking the purchases, I had downloaded something free, then used paid for 2 in-app purchases ($125 and $65). Using Google Translate (from Chinese to English) I was able to find out that I had downloaded the free app 'Rage of Three Kingdoms'.
All of this raised alarm bells as this was not activity that I had done via my iPod or via iTunes, so I spent the next 20 minutes navigating the awful Apple Support site and managed to log a email ticket.
I called the bank and let them know what had happened, although as the new credit card in the store was not actually mine I hadn't lost any money in this 'transaction' (only my 98 cents store credit from a gift card I loaded over a year ago)
Now I guess I wait and see what Apple come back with.