In most of these cases purchasing is done by using following crucial information of the credit/debit card :
While it may be that the Card Number and the validity of the card is made available to the fraudsters through insider in the bank, the OTP is procured by them by deceiving the account holder to share the OTP on the pretext that it is required for account verification, etc.