If you start with known valid CC numbers, the rest is just brute force to crack the CVC. Scripted attacks for this are common. Find an e-commerce site with a re

If you start with known valid CC numbers, the rest is just brute force to crack the CVC. Scripted attacks for this are common. Find an e-commerce site with a really poor checkout process, no rate limiting, etc. Brute force account creation and card tasting, and hammer it until you get hits. I've seen it first hand.