>The actors I've seen taking advantage of it are highly unlikely to front up with a credit card and provide what amounts to personally identifiable data (i.e. make a credit card payment) in order to mass enumerate the API.
Unless they just steal a credit card. Not unlikely, given who we're talking about here.
novaleaf|6 years ago
Using an "exhausted" stolen card would get flagged by a good payment provider (Stripe!)
The only issue is in some parts of this world credit cards are difficult to obtain.