Attackers load thousands of unverified card numbers into automated software scripts.