The scammers put that in already. They just show you the auth form for the transfer in the page you expect to be a payment-for-goods authorization.

There is a papertrail, as i mentioned, but the CC ecosystem seems to be not too interested to kill it. They derive legitimacy off and make money off scams.