Hey there, I'm the CEO of Sift Science. Unfortunately, callmeed is spot on -- law enforcement typically won't get involved unless it's in the tens of millions of dollars, at least. Even trickier if it's across international borders.

This means that you're left to defend yourself. Typically, you'll start implementing some basic verification and rules in your code base. For example, "if num_credit_cards_per_destination > 5; flag_as_suspicious()". But, it's tough to be accurate with this approach, so you'll want to manually review activity flagged by rules, so that you don't insult your good customers. As your business grows, it's more challenging to scale these fraud detection rules and manual review operations. While adding more verification helps, it does negatively impact the experience for innocent customers. It's a delicate balance.

I wish I had better news. In some sense, seeing fraud means that you're on the map. Unfortunately that means you'll only attract more and more attention as your business grows. I'm happy to be a resource, even if we don't work together - jason at siftscience dot com.