Callbacks have been the traditional fraud-prevention method, but they don't work (anymore)