Why would fraudsters use a browser that's likely to be blocked? They'll be using the standard browsers like (mostly) everyone else.

edit: it's noted downthread that automated testing of card details to find valid ones is a reason.