> business who takes credit cards online, wants to try to exclude people who will commit fraud

How bad is it nowadays? Can't you just enforce 3DS2?