What?! It is definitely credit card fraud, and a criminal enterprise, and by any definition it is wrong. I cannot imagine a jurisdiction where this is a “mere breach of contract”.
This is about controlling who gets to use the tokens for what, not about payment fraud.