It all becomes a bit clearer...
Over the weekend I got a letter from froogul to tell me that my points card would run out on the 7th and that a £29.99 monthly charge would now be made till I cancelled. How could this be? I do not have such a card and I have never, ever, been in touch with froogul.
However, according to the letter, the Username on the (new) card is a Mr Radcliffe (that's obviously not me) and the Password was given as Max. There is no way on Earth that I would have such a weak password and also companies do not usually send username and password / PIN details in the same letter, so off I went back to the bank's fraud department.
As we were going through things we discovered that the letter re the card was sent to Mr Frank Radcliffe at my address, and so was the box containing the drone. That's my fault in not picking this up by not wearing my glasses when picking up mail or deliveries.
Anyway, all is safe and secure.
Tip to myself: Always read the name and address on things pushed through the letterbox.