I guess another possibility is they could be using hacked/stolen credit cards