Any system that blocks people has two failure modes, and only one of them is loud.
Fraud that gets through arrives as a chargeback, a support ticket, a cleanup job. It has a cost you can put in a spreadsheet and a person whose week it ruined. It gets reviewed.
A real customer wrongly refused closes the tab. They do not file a bug. They do not email support. Nothing in your dashboard records that they existed, and the metric that would have caught it is the absence of an event.
The structural consequence is what bothers me: if the only feedback reaching you is the loud kind, then every review concludes the rules are too loose, and they tighten. Forever. Not because anyone decided to be aggressive, but because one side of the ledger is invisible and the other is not.
Things I have seen actually work against it:
