I believe that's incorrect under GDPR. There is a legitimate interest to keep records for fraud use, and also they must not delete anything that's required for

I believe that's incorrect under GDPR. There is a legitimate interest to keep records for fraud use, and also they must not delete anything that's required for regulatory compliance. GDPR is very clear on that.