I am sure they have balanced the two and come up with an acceptable level of fraud (maybe 1-2% ?) that has a low enough false positive rate (maybe 1-2%). Actual % will vary depending on what they deem optimal for profit.
In simplified terms as a merchant you generally want to see less than 1% of your sales as fraud. That's typically the baseline because you start seeing very hefty fines from card schemes like Visa and MasterCard and other providers if you go above that. Prolonged failure to keep fraud at a minimum in worst cases loses you the option of transacting with them at all.
If steam started revoking stolen keys, then it would be a different story
Steam revokes keys by the thousands every single day, and also provides reporting to merchants selling on steam to enable merchants revoking keys on their own systems. Steam also supports direct integration. The reason Steam keys are still around I imagine is a combination of a few things, Steam's market size, the sheer amount of keys still in circulation, and that they simply put can currently afford to eat the costs associated with keeping keys as a commodity to be abused around.
As someone not familiar with the fraud, can you explain what you mean for my uninformed mind?
Kittens McMittens gave a brief explanation of the problem, quoting below.
People buy them with stolen card details then flip them on key-reselling sites. People will tell you that you should just check publisher sites and only buy from authorised resellers, but seriously: who's going to do that? In fact, how would most consumers even know to do that?
Basically, where you as a customer see a good deal, fraudsters see the same good deal but at scale. Which they will abuse and abuse until it's dead in order to make profit, usually without spending any of their own $ capital. Sourcing their capital instead from stolen payment instruments, or accounts. Compromised accounts and payments are sometimes used, but not necessarily. There's an entire fraud industry around generating accounts and building bogus but good-looking customer histories that can fool first line fraud prevention systems on various platforms. Accounts that then gets traded or sold for the sole purpose of using them to commit fraud later down the line whenever opportunity arises (sales, big launches etc.).
It's never a dull moment in the fraud and security industry let me tell you. :)
Keyless integrations removes the commodity that fraud can very very easily abuse to make a profit, or at least, it forces fraud to invest resources in creation of accounts to actually abuse the system. Accounts which are much easier to collect metrics around to trace and prevent.
These mitigation factors impact legitimate customers also of course. You can no longer give a key to a friend, your friend has to have an account first etc. etc. One bad actor (or in this scenario, organised crime) ruins the fun for everyone else.
