The thief has more account data than the average real customer, but is missing at least one piece of information that matters.