> they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime This is accurate. >> Onlin

> they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime This is accurate. >> Online customers with established payment history... > What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. They can't tell you. Bad actors will even binary search the parameters of your fraud detection (source: I worked in fraud detection). Minimizing the information feedback loop to the baddies is super important to avoid becoming a loss function they can optimize against. This is true of every fraud department. Abuse detection is cat-and-mouse. Say as a provider I track your true IP through proxies by embedding some flash that calls home. You figure it out and block flash or do some clever sandboxing. I work with proxy providers to build blacklists. You somehow get the blacklist and just avoid all proxies on it. Etc etc.