First of all may I say how relieved I am that years ago I chucked Norton, they are terrible and as in one other thread I concur with Eddie's suggestion of MIcrosoft Security Essentials.
As for the card it sounds like what some of the other users are trying to explain is that as long as this new number applies to the same account and Norton has your name and bank they can still access the account through that information. Said access doesn't explain how they acquired the new number as it shouldn't be openly listed anywhere. Even when you yourself access the bank's website to view transaction history it should be censored out.
That's quite suspicious in my opinion not to mention inappropriate activity (new number or not) and I'd speak with my bank.