Since the card is delivered to your address, authorities can just email goblin to have that information.
If in a certain country goblin cards start being used in any noticeable way I'm sure authorities will likely make that inquiry. And why would goblin refuse to answer and risk their business. With the address a card was sent to it's easier to identify each holder of a card behind the transactions. You only need to be identified once. Afterwards the same card is linked to you jn perpetuity. So this can also be done by getting shipping records if you shop from remote merchants.
Today, packages can be ordered in a PO Box or redirected in various other ways so that the sender does not know your real address or any other information that can be linked to you. Of course, by using the card, the user reveals some things about himself, but considering that this is a physical card, it is logical to withdraw cash to an ATM and then spend it without leaving a trace of your IP address anywhere.
Also, if you want to stay under the radar, then you won't withdraw crazy amounts even if the card allows it, and it's also important to know in which country the card was issued. The card in question is issued by a bank in Mexico and, as far as I know, is already in someone's name.
It is obvious that behind everything are people who have good connections with banks and local financial agencies, which means that this card is probably a cheaper version of those physical cards that one member has been selling on the forum for years and which cost 1000 + EUR for one year of use.
The matter is very simple, first they find someone desperate enough to go to the bank and open a bank account in their name, and then for a fee they hand over the card and PIN to those who sell it to someone else.