MD5 Hash of concatenated CC# & street address for all orders. Post to a database 90 days after the order shows no signs of fraud.

Use existence in the DB (weighted by number of instances) as a probability of not-fraud.

My guess is Shopify, Stripe, etc are doing something like that when they send "this might be fraud, you should review" alerts.