[laurencei]

Excluding the part of how the access was gained (i.e. fault of end user etc) - I would have thought Stripe would have far better security measures in place for obvious signs of fraud?

If someone changes the bank account of a business for funds to be sent to - why not have a short (?48 hours) delay in allowing funds to be sent there. Especially if the business has been running a while (not sure in this specific case) with no bank account changes - then its not unreasonable for a built in delay for new accounts to be used.

Coupled with some basic stuff of "new bank account, new express accounts, spike in charges, sudden request(s) for withdraws" seems like something that a smart team in Stripe with their development experience could easily implement as an automated security trigger, and hold the funds pending additional security checks?