It's a signal. False positives need to be handled in some way. For captcha, they give you a captcha. For payments type stuff it's likely just one of hundreds of

It's a signal. False positives need to be handled in some way. For captcha, they give you a captcha. For payments type stuff it's likely just one of hundreds of signals you can use to build a score that can raise a manual review above a certain threshold. There is a company or two in this space that do an OK job of it.