Card. The thief had booked $1100 in Untied flights. When I called the cc company, a transaction with Apple (just over $1500) had been rejected.
Crooks are stupid; not only do most people have card amounts above which a notice is emailed to the cc holder (so don't buy something big)...don't purchase something (airline tix) that has your name and home address on it.