A VPN won't work in this instance without a US credit card. So it's completely possible.

As other posted noted, US cc is, by far, the easiest piece of information to acquire by a determined actor. Possible and inconvenience, but that is about it.

Why is that? Well, not to search very far, I just got a breach notice from a company I never heard of the other day. They are sorry.

I'm so glad none of those US credit cards have never been stolen.

Can you imagine the disaster???