Card issuers and merchants collectively lose 0.1% of GMV to fraud. At Stripe's scale that's hundreds of millions per year — mostly from device-level fraud that rule-based systems can't catch: account takeovers after card resets, synthetic identities with fresh device fingerprints, bot networks cycling VPNs.