This. Exactly this. Some company in the US does the VoIP->POTS connection. Someone's name and CC is on their file.

Saying "oh there's no way to know where the calls come from" is just lame excuses. CallerId spoofing is one thing, but POTS has other systems.