It is unlikely that you will ever find out where the fraud took place unless it is internal at home or work. Also, not worth the effort. Just doing all the things above will protect you for the near-term. The OTP is critical as it would have prevented the fraudulent Amazon charges from being processed in the first place.