If the checker is running the cards on their own merchant account and refunding immediately? Or doing auth, but not capture?

That's going to be in records of accounts that eventually report compromises, and get figured our pretty quick, I'd imagine.