[tyingq]

They had access merchant accounts to do pre-authorizations. Which is risky, because it's easy to trace back and shut down, so you would need lots of them. I imagine they had found a large-scale way of gaining merchant account credentials, or somehow triggering ONLY a pre-auth, that nobody else had figured out.

Maybe abusing services that have "free trial, requires credit card" ? I bet a lot of those do pre-auths.