Alright so, after buying something from the site my card was locked and now I have to confirm purchases to see if there's an fraud. The first one was the amount I spent on a game going to a hobby and game shop in Poland, which I assume is GOG, being Polish.

but the second was the same amount for a hobby and game shop...in California. What's up with that?

Contact GOG's support directly.

https://support.gog.com/hc

This was my bank calling me though, not GOG. And it says "weekends we can only respond that quickly to high-priority, time-sensitive cases. All other cases will be looked into first thing next week."

I'd really rather not have my account locked for two or three days.

So, from whom do you want an answer then?
Also, it's the weekend for Gog too..

Just to back up - how do you know your card is locked? Did you receive a text from your bank? Voice mail? Presumably if they'd called you would have just talked to them. What do you see if you log in to your account online?

Edit: Also, is it a debit card or a credit card?

What does GOG have to do with some weird transaction from a shop in California? Shouldn't you be questioning them?

Was this your first purchase on GOG? I remember reading similar threads in the past; some banks err on the side of caution and block (or at least put on hold) unusual credit card activity. A purchase on an online shop from Poland could be considered too "exotic" so your bank prefers to confirm it. Or perhaps you spent a higher amount than usual that day.

If that's the case, your bank's customer support service should be able to explain it to you, and then you can say that the purchase on GOG was intentional.

Your bank should also help you identify what the deal with the mystery order in California was (assuming you did not buy anything else that day).

This is why I always inform my bank that i'm going to be making a new purchase from some new site/store I don't usually frequent many times...that way they can "whitelist" that site/store and prevent the security lock from kicking in.

Most banks have security protection which may lock a card if they detect that the card is being used in a manner unusual for the card holder. That includes things like shopping habits changing all of a sudden compared to all previous usage of the card, repeated purchases in a short time window or any other "tell tale" signs which often accompany fraudulent card usage.

It is good to talk directly to your bank to learn about how their security measures work and what you can do proactively to ensure your online shopping (anywhere, not just on GOG) does not trigger their security protection mechanisms.

For example, GOG used to do payment processing in Cyprus, which would trigger a lot of banks to put cards on hold because a lot of fraudulent activity online happened through financial institutions in Cyprus at the time. So when a bank saw sudden transactions on a card going through Cyprus, with no previous purchases on the card going through there it triggered some security red flags, so they put a hold on the card until the customer can confirm for them that it was a legitimate purchase. In my case, my credit card company called me immediately on the phone after a purchase to confirm who I was and that the purchase was legitimate. After confirming it was a legitimate purchase, they put on my file that purchases from GOG were authorized so I wouldn't have problems in the future. I don't believe GOG still does processing through Cyprus anymore but I'm not certain, it could still be a thing.

Whenever someone is planning on potentially using their card for a purchase online which might be unusual compared to their past or recent card activity on a given card, it never hurts to call the credit card company up first and inform them of upcoming purchase plans so they can make a note on file. It can help to avoid security freezes on cards. All you have to do is call them and say "I'm planning on using my card on an online store I've never shopped at before and I want to inform you that the purchases will be legitimate so you can put it on my file." or something like that. Takes only a couple minutes usually and makes the whole process of online shopping anywhere much less likely to trigger security alerts.

Hope this helps.

Good points