I got it!!!3983 is a really, really old card which is an AU on my parents account in my name from years and years ago. The reason I even thought about that is because the "customer po number" that was listed on the receipt email which came later in the day was a number that I recognized but I couldn't place it. It took me a while until I realized it was for the "2nd line" in my parents house that has been disconnected for at least 15 years. But, once I had my parents house in my head I thought to check my parents cards and 3983 was right there. I told them to check it and sure enough the charge is there
They are in the process of reporting the fraud to chase and I chatted again with apple and was told this: "So upon checking here, the previous specialist already submitted a report to our Order Management team to have the order cancelled." - Yet, I still see it as waiting for pickup.
So,
But the billing address has to match with the bank/cc or the order won't go through - no? Even Amex which is most lenient requires zip to be correct afaik.
It did match because it was my parents address with their cc