No, there are no credit cards attached to my account. The commenter is mistaken. I also haven't received an emailed receipt so I suspect a larger backend hack. My systems are secure.

Depending on when this happened, keep in mind that Apple often delays receipt emails for up to a day (in my experience) and bundles the purchases of that day into one receipt.

So again, depending on when it happened, you may simply not have received the receipt yet.

Good to know. Thanks!

Ironically, the receipt JUST showed up now.

Since there's no credit card associated, it couldn't have asked you to verify you via the CVV in an automated way, so perhaps it skipped this extra security step that other account holders have.

That makes sense! I've removed all payment instruments at this point and remain disabled until I hear from Apple.

In my compromise I did receive e-mail receipts. Interesting.

Sounds like it. When this happened to me, they removed my credit card from my account because, I assume, they couldn't get past whatever fraud mechanics were in place. That, or they like stealing gift cards but don't want to commit credit card fraud. ;)