I think one big firewall against bots is being able activate an account only after a credit card validation. No need to charge the card, just validate.

And, if or when the card goes to be invalid anytime (stolen, expired, etc), all and every account related to that card will be locked. Not banned, just locked. Maybe a legit user just forgot to update card after a renew...