The attacker unfortunately doesn't have to use any aspect of the products that the site implements. In my situation I have different subscription levels, but the card attacker disregards all of it. Stripe really shouldn't allow for a card to be referenced without a predefined product also being referenced.
It's almost as is Stripe doesn't want to stop the attacks because they're making so much from fees
It's almost as is Stripe doesn't want to stop the attacks because they're making so much from fees