I know this is not what you want to hear right now but this is where the importance of KYC requirements for any company dealing with financial transactions comes in. I imagine you made a trade-off between providing a frictionless service and best practice, but that's a trade-off you need to pay for eventually.

EDIT: I would also like to add that typically those who dabble in credit card fraud are sophisticated enough NOT to link their own bank details to the cards. What they will do is either buy some unknowing person's account for a few hundred dollars or steal details of an otherwise inactive account. Then all they have to do is use any ATM to withdraw the money, and it can be nearly impossible to catch the culprit without committing significant police resources.