At the end of the day, letting criminals dictate how you do business with legitimate customers is not OK.

Simple due diligence will either eliminate the genuine criminals, or it will not. If five minutes' worth of due diligence by humans fails, then so will any conceivable AI algorithm.