Yesterday received new CIMB Preferred credit card (Pay wave) via Poslaju but havent activate it.

This morning 3am received 2 transactions in USD 300+ and USD 500+.

Call customer service to bar it and they told that the transaction is from the new card.

How can someone fraud with the card even before activation? The envelope is unopened.