I've been googling to see how a fraudster could benefit from using stolen card details to pay for motor insurance. (It's unlikely that he'd simply insure his own vehicle that way, as it would seem too obvious). There seem to be (at least) two known methods:
1. The fraudster advertises his services as an insurance broker. He collects genuine details from potential customers but then modifies them before submitting them to insurers (e.g. by omitting information about penalty points and convictions). So he can then offer a far cheaper price than others can, making sure he gets the business. He ask for a cash payment, telling the customer it will help keep the price he pays down. He then gets (invalid) insurance cover for the customer, using stolen card details to do so. So the customers gets what appears to be a a valid policy (unless he bothers to read exactly what it's based on, which many people don't), with the fraudulent broker pocketing the cash.
(Source:
https://www.confused.com/car-insurance/guides/ghost-brokering-could-your-car-insurance-be-a-fake )
2. The fraudster insures a vehicle using stolen credit card details. He then contacts the insurer to add additional cover, paying with his own card. He then cancels the entire policy, requesting that the full amount, less any cancellation charges, be repaid to the second card.
(Source:
https://www.manchestereveningnews.co.uk/news/greater-manchester-news/complex-scam-steal-thousands-pounds-14232919 )
Exactly how fraudsters get hold of card details often seems to be a mystery. In the days when you handed a card over to a retailer (rather than just tap it on a card reader or put it in the slot) it was easy enough for a dodgy trader to have a camera under the counter which could photograph the card details. These days it's more likely that an internet trader's database gets hacked, so that the hackers can see the card details of people who've bought from his site.
Even so, how some card details fall into the wrong hands still seems difficult to understand. I had a cash card which could only be used in ATMs. (i.e. it was neither a credit card nor a debit card; it couldn't be used in stores or online). I only used it for my reserve account, which I hadn't touched for a couple of years, so the card had never left my wallet in all that time. (Even if it had, the PIN wasn't with it). However I still got a call from my bank to say that £800 had been withdrawn from cash machines in Stratford, London, over three days, apparently using the card which I'd still got securely in my wallet. So I haven't got a clue as to how it was done!
Sometimes even reputable (and normally trustworthy) companies can have ridiculously lax security procedures though. The rail company I worked for used to send a daily summary of season ticket transactions through to the ticket office at our station. They consisted of dozens of pages of customers's full names, addresses and dates of birth, together with their card numbers, expiry dates and security codes. It was a weak enough system to start with but at least the information was only being shared with the small number of staff in our ticket office. However when their own fax machine broke down we started getting those faxes in our customer service office, which had a constant flow of platform staff, cleaners, drivers, conductors and others going through it. Further, it was also open to the public and could sometimes have no staff at all in it. So vast quantities of personal data were left lying around in an environment where almost anybody could read them, right next to a fax machine that also had a photocopying facility!