It's always about costs - cost to run the service, cost to abuse the service.

I was founder/CTO of a UK small e-money issuer, and while I am no fan of Musk, at PayPal he made a good observation that while the money handling bit is not so hard, the anti-fraud part is.

I also created/ran an early UK ISP, helped moderate a busy (US) forum, etc, etc, and I observe that while you generally cannot eliminate bad behaviour, you can make it costly enough that you stop being the easy target and attention goes elsewhere...

And you should have a range of broad signals to evaluate with.