Rate limiting and anomaly detection are the real gatekeepers here. A lot of "fraud prevention" is still reactive.