[sfe22]

What if they refund it immediately? Maybe that is what they did, to avoid detection. Anyone knows more about this?

[toast0]

If the checker is running the cards on their own merchant account and refunding immediately? Or doing auth, but not capture?

That's going to be in records of accounts that eventually report compromises, and get figured our pretty quick, I'd imagine.