Theoretically, having their Apple-issued dev certificate revoked (IIUC which bans all apps tied to that certificate) and Apple dev account closed.

But I guess these folks have contingencies to create new dev accounts that look unrelated and still come out net positive of the dev account cost quickly.

Creating dev accounts with fraud is super easy. Apple has no way to verify whatever documents they ask for proving your/your company's identity are authentic.

But Apple still have to pay you, right? Wouldn't it be suspicious if payment details doesn't match?

Presumably they already have a solution around that if they're scamming people, or maybe they're in a country where law enforcement is so lacking that this practice is normalized and low-risk, so they can just do this in friends/accomplices' names for a small cut of the profits and not have to worry about concealing their identity from law enforcement.

You don’t get paid for nearly 60 days so if someone reports you all the work you did for your scamming is for naught.

I guarantee Apple automatically refunds users when they ban a scam app.

Any iOS user can get a refund from the App Store, they just have to ask, and the process is pretty much automated.

Unfortunately few know this. I had a template email for unhappy customers that would walk them through it.

What if Apple has already paid the developer ? The money is in their bank account. Then Apple is at a loss.

I don’t know the details of all of Apple’s refund policies, specifically how far back they go in cases like this. But I can say Apple isn’t worried about taking a loss to ensure their customers get treated fairly.