From talking with some of the companies experiencing this, I can confirm that a portion of it is actual credit card fraud. Tokens have become a pseudo-currency, making them a prime target for abuse.

Some of the abuse is more benign, but there is also real fraud through chargebacks, account takeovers, and stolen credit cards.

Any situation where you can extract a benefit from a stolen credit card and then sell that benefit before the chargeback renders it moot will have some fraud-based usage.