Most of these are your standard botnet rings. Either accounts directly are taken over, and the attacker adds 2FA or carding rings take stolen #s and attempt to add credits.

It is...incredible how many there are. Stripe does far too little in my opinion to help prevent issues like this, even though they have the business intelligence and enough data to do so.