I've had this w. Amex, BOA & Chase.

1. They can't and aren't going to provide you any details. Frankly, you don't need them.

2. They, not you, are responsible for fraudulent charges and will act accordingly. Sure, would be great if they called first. But, it's their nickel, not yours.

3. Whether or not the immediate fraud suggests a password change, you should be changing yours regularly.

4. Don't worry about the credit report from the credit score perspective.