Should a credit card co. give an authorization to use a new card after 2 verification failures?

over the course of three days and two failed verification calls, my credit card company gave the authorization to someone to use my card when they finally came up with the right ss#. I don't think a person should be able to "keep on trying". An authorized user knows their ss# the 1st time,or I should think so.