How do they know that fraudsters with fresh cookies and no referrer history aren't just in private browser mode? Sounds like the server would view them as the same in most cases.
You can try that in the console of Firefox:
var request = window.indexedDB.open("MyTestDatabase", 3);request.onerror = function (event) { if (event.target.error.name === 'InvalidStateError') alert('private mode')}Problem solved.