Fraud and auth are two orthogonal things. The only thing this does is save you from implementing a really basic login system which is really not much code to im

Fraud and auth are two orthogonal things. The only thing this does is save you from implementing a really basic login system which is really not much code to implement if you use something like devise or some other auth library. if fraud is a goal to prevent use something like paypal or stripe which is better than small shops at detecting it over some generic merchant account. All this does is tie people into one closed system identity which most people have more than one functional identity(e.g. my business identity is different than my personal identity is different than my family identity). If you force me into using facebook to login to a system where I might legitimately want to separate personal, business and family accounts you lose me as a customer. Also, you may be using some service on behalf of someone else and then what? the customer has to give you access to their facebook account? it's just shortsighted and, frankly, dumb to only allow facebook/google to control auth. use it as an additional auth mechanism if you want to but don't solely make that your only method.