WHY is enforcement so difficult?

I'm far from a cyber expert, but if they are even remotely sophisticated, they can hide their IPs, and obscure their identities. Don't ask me how, but from what little I know, they can do it. It then takes another expert to unravel it. Could it be Bluetooth? Dunno. It's short-range, and requires pairing. But I wouldn't be surprised if there's a hack for that. I do know that one has to be very careful connecting to public wifi. Apparently, it is pretty easy to spoof that.

I suspect that the people who obtain the information don't actually use it; they sell it. Let someone else take the risk of being traced via shipping addresses, AirBnB records, or whatever. That puts a layer between the cyber thieves and the "end user" thieves.

I'm curious why they don't investigate, however. The folks getting services are just as guilty as the folks that stole the info in the first place. Trace addresses (e.g. the Costco membership should be easy, in my case).

In the case of your brother, they seem to be sophisticated and experienced. I would think a fraud unit (FBI?) would be interested. Not interested in the single instance of your brother (no offense), but that this could be a more extensive network of criminals that have victimized possibly hundreds or thousands of people.