I agree, and think the article writer agrees, it was mainly their fault (after the actual fraudster of course). I still genuinely don't understand why such a b

I agree, and think the article writer agrees, it was mainly their fault (after the actual fraudster of course). I still genuinely don't understand why such a basic thing as ip restriction is not part of the security settings in stripe. I keep looking for it thinking I must be missing it. On the user's site, it could be as simple as a fail2ban rule to deal with most of this. And no doubt he is not the only one to have done such a thing, given the number of libraries and frameworks people throw on their sites, all with their own layers of configuration.