The article stated that Tesco weren't protecting against distributed card testing because they didn't track failures on the same card across different merchants

The article stated that Tesco weren't protecting against distributed card testing because they didn't track failures on the same card across different merchants. Thus I think it would be very plausible. The people running the scam would choose a specific IIN/BIN known to suffer from this problem.