&gt;Don&#x27;t dismiss the tracking cookie so quickly. Every dirty marketing technique you&#x27;ve ever heard of from Evercookie to using eTags to accomplishing the same thing make it easier to get &quot;device ids&quot; and coalesce that information to fraudulent user ids as well as the accounts, ips and transactions associated with them.<p>Most of the more &quot;serious&quot; types use setups similar to FraudFox that defeat systems like these (Although this too causes detectable patterns, new customers with 0 tracking cookies putting in orders less than 30 minutes after initially hitting the site are probably fraud). Don&#x27;t forget that the Pareto principle applies here, to be able to perform large scale fraud you need lots of cards which requires investment which requires that you&#x27;re successful.<p>&gt;Services like MaxMind go a very long way in identifying proxies or Tor nodes as well.<p>Nobody uses Tor, at best that&#x27;ll prevent some kids using public proxies (which are worth stopping mind you, but that generally only accounts for a small fraction of the fraud). MaxMind is a joke and struggles against stuff like vip72, and has absolutely no chance against anything more sophisticated than that.<p>To be honest you could probably replace MaxMind with DNSRBLs and do just fine<p>&gt;The flip side of that is that actively engaged attackers become easier to identify in terms of patterns of behavior and leaving trails to alert authorities.<p>Authorities do not give a shit, they might go after card shops but they definitely aren&#x27;t going to do anything about some guy doing orders to Russia.