Had a discussion with AI about this afterward, and it helped connect a few dots.
On the scale of it: FBI IC3 reported $20.9B in online fraud losses in the US alone in 2025, up from just $1B in 2015 — a 20x increase in a decade. Combined with FTC data, the reported total hits $36.8B. That's before counting unreported cases or anything outside the US. At that scale, "fraud as a business" isn't really a metaphor — it's organized, well-funded, and iterates on its tactics the same way any other industry does.
On why fraudulent operations look like normal companies: it's not that they're especially good at faking it — it's that the bar to legally form an entity (LLC, EIN, D-U-N-S, business bank account, website) is so low that it filters out essentially nothing. States profit from registration volume, not from vetting legitimacy, so the paperwork trail looks identical whether you're a legitimate solo developer or a shell company.
On why Apple doesn't just clean up after the fact: banning an account post-hoc means the damage (chargebacks, scammed users, reputational cost) already happened, and re-entry is cheap — a new LLC is a few hundred dollars and a few days. So front-door verification, as blunt and painful as it is, reduces total fraud volume in a way that after-the-fact bans alone can't.
On why they don't just permanently ban the person instead of playing whack-a-mole with entities: it turns out Apple's identity verification does try to do this to some extent. Per Apple's own documentation, their ID verification vendor extracts and retains the document ID number (passport number, etc.) during the photo ID check — not just a one-time face match. In theory that ties a fraud flag to the person, not just the account or entity, so switching Apple IDs or forming new LLCs doesn't necessarily reset anything if the underlying ID is already flagged.
The catch is this cuts both ways. It can't distinguish between an actual repeat offender and someone who tripped a cluster of unrelated risk signals for the first time — which might explain why my phone call ended in a flat "final decision, no appeal" rather than a specific reason. If the block is sitting at the identity/document level rather than the document-quality level, no amount of resubmitting cleaner paperwork under the same passport would move the needle.
And it turns out this isn't just theoretical for me. Support had suggested enrolling as an Individual instead, so I tried creating a new Apple ID to do exactly that — and got hit with "ID verification rejected" on the very first identity check, before any company or D-U-N-S info was even involved. I reported it back to support, who said they'd look into it. So at this point it genuinely looks like my personal identity information itself may already be flagged, independent of the LLC. Which is a pretty stark example of a legitimate user getting caught in the same net as actual fraud.