The lowest hanging fruit would be to switch to Stripe. They have a very decent anti-fraud tech, so that alone can help.

Secondly, you can try and track fraudsters better. Start with the obvious stuff, like blacklisting all their known IPs and basic cookies. Don't block them based on this, but rather emulate card failures exactly how they would've happened normally.

Blacklist Tor IPs (there are DNS-based lists for that) and VPN exits (same here).

Next, add browser fingerprinting - calculate the fingerprint, report it back as a cookie or with an ajax call and check against another blacklist.

Cross-pollinate blacklists - a hit on one (e.g. by IP) should automatically add entries to cookie and fingerprint ones.

Further, add heuristics - check their timezone as seen in their browser, check their supported languages, compare that to their country as deduced from the IP.

Your goal is not to block them. Your goal is to fuck up the accuracy of their card checks so that they would leave.