“An attacker who plans to test the cards (as they normally do when obtaining them) or attackers who try to use them will immediately advertise their presence, and your response team can spring into action.”
Thinkst now hands out real, valid card numbers with expiry and CVC that fail on use and email you the merchant and amount. Drop one in each payment database and the alert tells you which store leaked. Crooks always test stolen cards first, so the thief becomes the tripwire. Most companies learn about a card breach from their bank months later.