[DontRunDontTrip]

99% of such victim companies won't be wasting their resources on doing what law enforcement's job is.
Unless someone would be raping a company excesively I doubt any company would actually be filing any law suits against common se'rs.

In Germany, the company most of the time, are involving their in house or external lawyers
These lawyers are not fucking around and will track you down
Or they will just file a police report, with all the information. If you dont have a good OPSEC, its over.

Especially when the company realize, they have gotten a lot of refunds and seeing a pattern. Such as DNA etc.
OTTO, NBB and MindFactory are only a few examples

It might be more of a question of internet privacy/security, rather than SE.

As we all know, we should always use VPN, block cookies, maybe use different devices etc. in order to stay anonymous when SE'ing. However, I believe almost everyone pays with a Paypal/bank account/credit card created on their real identity. Doesn't it make it super easy to track a person doing fraud? Is it possible with law enforcement involvement only, or can they do it on their own??

I always recommend gift cards or prepaid credit cards
If it doesnt go by plan and they are threatening you with law suits or whatever, they got nothing.
Obv, you need to have a good OPSEC!