Zero-retention architecture solves the storage problem, but teams also need to detect when stolen identities create fraudulent business entities in the first place.

One signal worth watching: domain registration patterns. If a domain gets registered right before a fraud cluster appears, that timing itself is evidence. Pulling WHOIS data through something like WhoisFreaks can show exactly when a domain was registered and connect it to the breach timeline.

Same principle as your approach: extract the signal (registration date, timeline match), discard the raw record. Fits the zero-retention model well.