> Your rate limits on adding and removing credit cards?
All those requests will appear from different ip's and different browsers, made by someone who can spend months on trying to defraud you. How do you differentiate this from valid customer who happens to try to buy something between 20 tries by bots?
> Your input sanitization?
All those fraud requests will give you valid credit cards which will work perfectly, but then defrauded people or banks will try to chargeback later.
> Designing your system to not just disclose details around anything but that relevant to a logged in/authenticated user?
They can register as normal buyers.
> It just requires thinking and a bit of dev time.
And they can spend months trying to outthink you, then will drain your service in 4 hours when you are asleep.
> Management was deadset against doing the one single thing that would make it impossible to do that at scale.
So, did you actually ever implemented and checked a good solution? Cloudflare isn't perfect, but not everyone has resources to implement their own solution that is better than cloudflare.
> Fingerprinting is far more intrusive than just only allowing one to add at max 2 cards a day per user.
The fraudsters will appear as completely new users each time, adding only one card and making one purchase.