Barring that, detect mining and terminate it with system monitoring tools, and prevent port scanning/flooding at your network border (your netops team is active on NANOG and seem to know what they're doing).
I assume they look for name on ID that matches name on payment method. That's what I used to do when I worked in a hosting company ~10 years ago.
This way, if someone has a stolen credit card, there's a very good chance, they won't have a matching government ID with same name. Hence obvious fraud.
