>This seems like a horrible way to do both of those things... very easy to track, and you don't think Apple/investigators will notice if a lot of stolen cards are buying the same app?

Doesn't matter if the cash has already been funneled overseas. Good luck extraditing someone on credit card fraud from Cambodia.