I can't speak to anything but my own experience. Having helped on a few ecommerce sites for very small merchants, the amount of fraudulent purchases that came t

I can't speak to anything but my own experience. Having helped on a few ecommerce sites for very small merchants, the amount of fraudulent purchases that came through was staggering. One of those companies has been open for about six months now and is only breaking even in large part due to the expense of dealing with chargebacks. What they have observed is that a significant number of cards were tested through what appears to have been a rented botnet. Those went away with the addition of a captcha. The remaining fraud that looks like card testing (only purchases of low value items, with IP's far away from the billing address and similar peculiarities) are often done from Tor exit nodes. Small merchants have very little support in this area. Local authorities often don't care or have the man power to deal with these types of issues. The banks and visa/mastercard also don't care since they just force the merchant to eat the costs and still collect all their fees. It would be very difficult to tie these transactions back to any one person in most cases as the tester is going to be using a valid card, valid billing/shipping address. Once they know the card works they can just have a mule go get a cash advance from an ATM or start having big ticket items shipped to various places for pickup. Or they just resell the card info as verified which increases the value significantly.