That’s because hacks go down in phases. One set of cyber attackers steals the information—say, by hacking into a major retailer like Target (TGT) or Home Depot (HD). Those thieves sell that purloined plastic—or, more specifically, the data behind it—on online black markets and crime forums. There, a final set of fraudsters purchases the data to make unauthorized transactions. It’s an assembly line for digital iniquitousness.

If your payment card information hovers in limbo between those stages—up for sale on a baleful bazaar, but not yet in the hands of those anchor leg crooks—your bank may know it, because security firms trawl the “carder” underworld to compile lists of stolen data that they then sell to banks. But from there, “fraud is a numbers game,” says Ricardo Villadiego, CEO of one such firm, Easy Solutions of Sunrise, Fla. Since each reissued card costs the bank around $5, the expense of retiring a card may not be worth incurring until somebody starts misusing it. “Just because data has been compromised doesn’t necessarily translate to losses,” says Villadiego.

The bigger the bank, and the closer the stolen card is to its expiration date, the less likely the bank is to replace it, experts say. Banks and payment companies Fortune spoke to—including Chase (JPM), American Express (AXP), and PayPal—declined to comment about whether they use carder research services. But Avivah Litan, vice president at Gartner Research (IT), says bigger banks often find it more cost-effective to keep watch lists—and to act only if things get ugly for them, and you.

A version of this article appears in the July 1, 2015 issue of Fortune magazine with the headline “Credit Card Hacked? Your Bank May Shrug.”