The article addressed that objection, though. 1. Only activate on sessions where it’s never activated before. 2. Only activate one in, say, seven times. 3. S

The article addressed that objection, though. 1. Only activate on sessions where it’s never activated before. 2. Only activate one in, say, seven times. 3. Sniff form once, fail to submit, show user "unexpected error, try again", allow normal behavior, success, user moves on 4. pull the numbers It’s nice to imagine we follow up every single JS or user reported “it fails sometimes?” error, but a clever malicious script author knows we don’t check 100% of the time. We are required to expect transient and potential errors from third party services, not even Stripe has 100% uptime. This kind of theft looks like a transient and unexplainable error.