I bought an expensive T-shirt a long time ago from a rather legit looking apparel company (nice website, LTD company/bank account).
Learned the right words on Reddit, hit up Instagram and started looking for and messaging people. Got a few replies, went with the one who had the most legit looking photos.
After a few questions on WhatsApp (yeah, really, lol) got directed to the website and bought the right item... via direct debit because their payment processor was "down".
Big risk on my part, I guess, my plan if popo called was to just say "hey I only ordered a t-shirt!"... I did not think it through very well.
Got it pretty fast (Royal Mail tracked and signed) and found a gift pack of "Revels" inside. How nice of them!
It seems rather risky for them, wouldn't it take just one guy to talk? Or maybe the seller was new to the business.
Tbf, setting up a company, bank account and shipping, all while staying anonymous is extremely easy (but not legal) in the UK compared to the rest of EU.
Credit cards and bank credentials being worth comparatively much less means that hackers don't have easy ways to secure the funds - either there's a high risk that the transaction is reverted, or there's a high risk that the hacker gets caught and goes to jail. You can tell it's not just an effort issue because the value of the accounts barely scale as the amounts in the accounts increase.
So if you were to gain access to a stranger's account, you'd have to transfer the money to an existing, old and actively used account. Which is likely to be your own or your friend's.
Seems like a huge risk, so the hackers just sell the account to some idiot willing to try it.