This is the second time this has happened in the past six months (and it's happened before that too). I've explained to them to not give our personal information willy nilly. How to spot phishing emails. Always check the actual email address. If you're on a website, see the actual URL. Contact the store directly. Don't not reuse passwords. I've set up things to make it easier for them as much as I can.
But I'm feeling so lost now. I lost my temper today. I know I shouldn't have done so. Obviously, they feel bad. We've locked the card and contacted the bank. They'll send a replacement. It's done, for now. But I know their information is out there. Their phone numbers, address, probably even their passwords.
It's like fighting a losing battle, hoping they never make a mistake that'll cost us thousands, if not more.
install adblocker on their pc if you haven't already. there are more comprehensive antivirus software too which keep up to date with new phishing sites by analysing html content.