So question then is, what's the scam?

Stealing card info? Selling the VINs to people trying to sell stolen vehicles? Or just producing fake CarProof-style reports for cheap.