That's correct - I'd suggest flagging for immediate attention based on activity bounds beyond the norm (3 declines from different cards for instance) and then hellbanning if appropriate. Obviously we'd never want a situation where a real user ended up hellbanned, so the final decision is left up to a human.