If negative keywords do not stop fraud, what does?

Blocking by behavior rather than by query. Start with the free changes: presence-only location targeting, no search partners or Display in search campaigns, and your own office IP excluded. Add IP exclusions for sources you can identify, up to the 500 per campaign Google allows. Then use software that watches click behavior and excludes worthless sources automatically, since manual lists cannot keep pace.