Comment by c16

I’ve run into this problem before and there’s ways to stop it. Sure your email blocklists work to an extent assuming they’re up to the minute accurate (which they’re not).

I’d look into fingerprinting (https://github.com/fingerprintjs/fingerprintjs), block by ASN if it makes sense for your business (does OVH really need access to my SaaS?), use an active disposable email checker and possibly flag risky orders for manual payment capture if at all possible.