[Hydraulix989]

If I had to guess, the combination of matching CCs + matching test devices (i.e. when _both_ are the same) has a fairly low false positive rate for identifying fraudulently-linked accounts.

This type of probabilistic inference is how fraud detection works in everything from Apple to Paypal to world banks.

I would even go so far as to call that aforementioned combination a smoking gun.