If your problem is credit card fraud you can simply enforce 3D Secure (which offloads liability) for requests that are considered risky. The customer can then choose to either use a 3DS-supported card or complete a captcha/etc.