It should only be a crime of stupidity once the source of the DB dump is known to AmEx/Visa/MC/Discover. Why? Every time there is a hack of credit card number databases, all the credit card companies have to do is shitcan all the numbers with the merchant field of the transaction showing the hacked merchant. So for example, Target credit card hack: all credit cards with 'Target' charges made to them in the past 60 days, shitcan, issue new card number, 2 weeks later physical card arrives at cardholder's billing address.