Does sound a bit odd and really you have left the bag where it was. I have had something stolen for me literally from behind my back in the past, so its always best to keep it hidden. Would be best to cancel the cards, as although he won't have the PIN or verification details, some websites accept payments without them.
Also, don't be that surprised soemone picked it up (if that's is what happened). Although a number wouldn't go near an unattended bag, not everyone will be that safety concious/paranoid.







