Here is my experience handling fraud in a very similar situation: 1) Checking the transactions manually only works if you have a very low transaction volume an

Here is my experience handling fraud in a very similar situation: 1) Checking the transactions manually only works if you have a very low transaction volume and you have to somehow delay the booking which is not always possible or desired 2) You can code rules like "asdf@" is likely fraud, or every email that doesnt contain a firstname (from a list of common firstnames) increases the fraud-score. But this rules list gets really long really fast and is almost always reactive (latest fraudster used a throw-away email, lets add a check for those). 3) You can use machine learning to convert inputs (name, email, amount, etc) to output (fraud score). That does work reasonably well and limits the amount of coding you have to so (see 2.) 4) The most important thing I learned: The type of fraudster who checks 100 cards with $5 transactions doesn't care (or maybe even notice) if 85% of those transactions/checks fail. He'll try again with the next batch and check the rest elsewhere. So you need to implement a system that bans the fraudster on the first try (or as soon as possible) and doesn't let him try again (unless he changes so many variables that it becomes to much work to outplay your system). I found a way to do 4. and we haven't seen much fraud since then.