The fraud-detection business has a dirty secret