Totally a drop shipping / stolen CC scam. I had something similar happen whilst buying a Fire Brigade on eBay about 18 months ago. By the time I received a package from Walmart and figured out what happened, eBay had already shut the seller down. They didn’t steal any money / info from me (I mean, obviously, the person whose CC was used got gypped, but hopefully had protection and got it sorted), and there was no further incident as far as I know. But yea, unfortunately the convenience of the digital age comes with many a method for deception and fraud…