Probably depends on how they acquired them (breaking into an online store's payment transaction database / trading for the CCs on IRC / lifting them using a physical skimmer / etc.)