They're buying a domain with free or cheap hosting to set up a phishing site to get more stolen cards or bank logins. By the time you notice and charge back the payment, they've already had time to spam that URL to a hundred thousand e-mails.