Agreed, being able to set the rules the way they allow is very powerful and once configured should basically get rid of these attacks. But why does every mercha

Agreed, being able to set the rules the way they allow is very powerful and once configured should basically get rid of these attacks. But why does every merchant have to learn what rules need to get setup to prevent these attacks, it seems silly. Also what is up with their risk score in situations like this: https://news.ycombinator.com/item?id=36197303 https://news.ycombinator.com/item?id=36197303