So the only real risk is the someone uses a stolen credit card when they first sign up.

Between some sensible prudence on Magic's part (limit transaction size for new users) and the banks' own fraud detection systems, the risk seems quite manageable.