Physical devices placed on ATMs or gas pumps to read card data.

Sellers are rated based on the "validity rate" of their batches.

Malicious code injected into legitimate e-commerce sites to "scrape" data during checkout.

Buyers can filter by card brand, bank, country, and even zip code (crucial for bypassing geographical fraud checks).

Large-scale hacks of retailers or financial institutions.

Before being sold, stolen details are often "checked" using automated scripts to ensure the card is still active and has a usable balance.