We do have that layer. We use Shopifys own risk rating (which is per our testing far superior to other solutions) and Mesa to stop capturing when there is an elevated risk. This works very good in most cases, but when there is again a massive Phishing spree going on with PayPal we get dozens of fraud orders in short time and they (partly) slip through Shopify. However, the last 2 weeks are quiet…PayPal is active again and they seem to have cleared the afftected accounts.
However, it’s just about time PayPal is requiring customers to enable 2-Factor.