It was more than just the credit card. It was test hardware in general, some of the stuff in the phone call suggested that maybe both accounts still share financial details, and there's probably other factors too that Apple doesn't advertise because they don't want to tell fraudsters how to avoid detection (e.g. perhaps both accounts were set up from the same IP address).