If I had to guess, the combination of matching CCs + matching test devices (i.e. when _both_ are the same) has a fairly low false positive rate for identifying

If I had to guess, the combination of matching CCs + matching test devices (i.e. when _both_ are the same) has a fairly low false positive rate for identifying fraudulently-linked accounts. This type of probabilistic inference is how fraud detection works in everything from Apple to Paypal to world banks. I would even go so far as to call that aforementioned combination a smoking gun.