It did cost them money to spoof an unknowing client, but they make money having a credit card form collecting fees before anyone else knows whats going on.