The GDPR's right to erasure is not absolute. Simplifying things a bit, you only have this right if
- the legal basis for processing was consent, because consent can be revoked freely; or
- the legal basis for processing was legitimate interest and the controller does not have an overwhelming legitimate interest in keeping the data.
Legitimate interest always requires that the controller's legitimate interest and the data subject's rights and interests are balanced. A request for erasure shifts this balance but does not decide it.
In practice, a request for erasure may be denied if
- the controller has legal obligations to keep this data, for example financial records; or
- the continued processing of this data is necessary for performance of a contract; or
- the controller has an overriding legitimate interest in continued process of the data.
Note that contracts may have effects that survive termination of the contract. Note also that a contract might not involve the data subject as a party to the contract, the classic example being a postal delivery contract that necessarily requires processing of the recipient's personal data.
In your specific example it seems that the legal basis was legitimate interest and that the data controller has an overwhelming legitimate interest to hold on to parts of your data for the purpose of fraud prevention.
If you feel like the continued processing of the data is illegal, for example because the legitimate interest balancing was done incorrectly, or because the legal basis was consent, then you have the following remedies:
- You can lodge a complaint with the responsible supervisory authority.
- You can sue the controller before a responsible court for compliance, and for the (actual) damages that you suffered as a result from illegal processing.
I'll point out that neither of these approaches is likely to work for you, because abuse/fraud prevention appears like a pretty standard case of overwhelming legitimate interest.