Could still trace the point/time of sale and pull security footage. Additionally, the authorities and the telcom could work together with a bank to generate a honeypot card, send it by SMS, and then track usage to identify members of the network.
The delivery address gives you away though. Either you or one of your associates is going to have to be in a specific place at a specific time to sign for the package.
Have you seen the security video that comes out of most convenience stores? You can't even make out people who rob the place at gunpoint.
90% of convenience store surveillance cameras make Ring doorbells look like tools of the NSA. (In terms of image quality, not the other way.)