On a different note, I'm happy to disclose the one heuristic BCC has since I'm the only one who can get negatively affected by it. I have several thousand names of people who have previously bought BCC, and they are a pretty diverse sampling of a slice of the American experience. If you hit the trifecta of a) a first name I've never seen before, b) you use a free email provider and c) you've never actually made a bingo card yet, your purchase causes my phone to light up so that I can refund it prior to the actual cardholder hitting me with a chargeback. I also add it to a spreadsheet that I periodically bug Paypal's fraud team with.

This heuristic has literally perfect detection and recall [+] against a particular carder ring, which was using BCC to test cards (via our Paypal account, sadly, so I have limited pre-charge options to fix it) this summer.

Paypal, to their credit, has apparently shut down this carder ring, since I can't remember that heuristic firing in 2014. (Edit: Poor phrasing. The heuristic not firing doesn't mean I'm safe. Having a historical level of chargebacks, which is less than one a quarter, rather than having the carder ring induced "20+ in a week." suggests that I'm safe.)

[+] Edit: It's 2 AM and I can't remember if this is the right circumstance for that jargon. What I'm trying to say is, of the universe of charges that I can classify as good or bad at N months after the charge, 100% of the ones this heuristic flags are in fact caused by a carder ring and 100% of the ones this heuristic fails to flag are, to the limit of my current understanding, not caused by that carder ring.