I guess it's inherently a hard problem serving two sided markets as the Russian criminal types are straight away going to set up a shell companies pretending to be something respectable on one side and feed in stolen credit card numbers on the other. Still you'd think they could do something transparent like delaying sending the funds for a couple of weeks while they contact say 10 credit card owners to see if the transactions are legit.