Fake or not, it would be best to change your passwords.
I just emailed a coworker about it, and he replied saying "makes sense, I had false charges on my debit card". I cant confirm it is related this instance, but it reinforces the above suggestion.