Can anti-fraud make large-scale attacks unprofitable?
Let’s assume a platform where users receive some form of benefit based on verified real activity. A major concern is whether organized fraud operations can scale profitably.
A common assumption is that attackers will always find a way around individual defenses. So instead of trying to make abuse impossible, the approach is to increase the cost of abuse:
device reputation and fingerprinting; IP/network reputation; VPN/proxy/datacenter detection; behavioral analysis; account reputation over time; graph analysis to detect connected accounts; risk-based limits and delayed payouts; manual review and feedback loops.
The idea is that a fraudster might be able to create accounts, but maintaining profitable accounts at scale becomes difficult.
The question:
Does this actually change the economics of fraud, or will sophisticated operators always find a way to stay profitable?
For example, attackers can theoretically use virtual machines, proxies, automation, and other infrastructure. But they also have ongoing costs:
infrastructure; acquiring and maintaining identities/accounts; operational overhead; adapting to detection systems; losing accounts and reputation.
At what point does the cost of running the operation exceed the expected return?
I’m especially interested in perspectives from people who have worked on the offensive or defensive side of fraud. What weaknesses would you expect in this approach? Which signals are actually valuable, and which are mostly security theater?
Looking for criticism, not validation.