It's not a GDPR violation.
https://gdpr.eu/recital-47-overriding-legitimate-interest/
> The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.
https://gdpr.eu/recital-47-overriding-legitimate-interest/
> The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.
I have absolutely no idea and am not a lawyer, it just seems to me that the word "strictly" is meant to indicate that it isn't pixie dust companies can sprinkle on any piece of information as they choose. The rest of the language here seems to stress that there has to be some sort of test which demonstrates that the interests of the controller overrides the interest of the data subject.