I'm sure they try their best to make sure they're valid and it could be stolen cards, but I don't know if they charge on the card to test it, and pretty sure you could generate multiple fake ones that link to a real one, so even if they tested, they would look like real accounts until much later on. At that point it becomes the difficult decision of whether you tell all users that even if they pay their rewards will come at a much later date, or you issue the rewards and take the hit for a few thousand keys. It's a lot I agree, last time I saw one of these it was like 3000 keys and I saw some for 1000 or 500. But if you look at it from the big picture, it's a tiny insignificant number for amazon. Did a google search on how many amazon prime members are there, and last year amazon reported 168 million members in the usa alone. That's like 1 in 3 people in the usa having prime. Like I'm sure they investigate it, but they probably don't go all out to revoke these because they probably already assumed a loss, and I think they pay for how many keys are activated by a certain date in like tiers like thousands or something.