It depends what they're selling. If they're selling something people want - the only answer is enforcing things like 3DS. If they are e.g. a charity receiving donations via card - they may still use it for card testing. Making card testing unprofitable is the point.