I do something similar (real-time detection of spam-comments) at https://blogspam.net/ https://blogspam.net/ and I'd be reluctant to even attempt to handle frau

I do something similar (real-time detection of spam-comments) at https://blogspam.net/ https://blogspam.net/ and I'd be reluctant to even attempt to handle fraud. If my site messes up then dodgy comments might get posted (unless they're blocked by other systems). If you misclassify an "is-fraud" check you either have a customer lose money, or a potential customer be denied service. Neither of those are great. I suspect actually doing anti-fraud testing could be done simply with a few heuristics, knowing the kind of attacks I see on other sites I run, but the only way to be sure is to get a lot of data-volume and real-life results to compare against.