All of them can be genuine use, these are fraud signals not fraud proofs, and the article does cover this:

> What works is running them all and scoring each transaction across the signals. A transaction that fails on three or four of them is almost always fraud. A transaction that fails on one might be your grandma being weird with her debit card on vacation.