It should only be a crime of stupidity once the source of the DB dump is known to AmEx/Visa/MC/Discover. Why? Every time there is a hack of credit card number databases, all the credit card companies have to do is shitcan all the numbers with the merchant field of the transaction showing the hacked merchant. So for example, Target credit card hack: all credit cards with 'Target' charges made to them in the past 60 days, shitcan, issue new card number, 2 weeks later physical card arrives at cardholder's billing address.

Anybody buying a list of invalidated, now effectively random numbers (that they can't use for anything other than toilet paper) is stupid, but the prison industry would sure like to have them as another inmate to profit from.