I don't have an official answer yet but I wanted to put my notes here and an answer seemed more appropriate.
Anyhow, many including paypal have recommended a captcha on the checkout page but I have yet to find a way to do this that works. I am currently testing one option and will probalby post about it if it works since theres nothing reliable I have found yet.
Another important detail is that I had disabled paypal payflow pro and yet I was still getting hit with credit cards. I think these were automatically rejected due to it being turned off, but the controller remained active and to me this is a security hole. In fact, the ability to manipulate this controller without going through checkout seems like a security hole to me. The malicious party somehow faked a quote.
I have blocked access to this url using cloudflare (which is created by
Magento\Paypal\Controller\Transparent\RequestSecureToken and accessible through
/paypal/transparent/requestSecureToken/ by the way).
I'm hoping to do 3 things: 1) throttle or block inappropriate access to the aforementioned url 2) add a captcha 3) look for existing patch to this.
The only recent and related info I found on this is: https://github.com/magento/magento2/issues/21781
If you're using paypal payflow chances are you are susceptible to this attack.
I am really behind on Magento though (2.2.4) so hopefully this was fixed already and I can blame myself for not updating.