Users created even though payment failed on Stripe (blocked by radar/wrong CVC)

#1

I had a user, or likely a bot card testing cards and my stripe radar rules were too lax so one payment actually passed, the other payments however were declined because of stripe radar detecting them.
I therefore adjusted the risk score from 90 to 50…
However I noticed even though the payment failed, all 3 users got created (was easy to spot it was card testing - because the bot used a different email address for each credit card , but the same name).

I got alerted to it because within short time two users got created with an email bounce (both times the CVC check failed too at stripe).
Strangely the third payment had a working email and CVC worked too. I still guess it’s fraudulent card testing.

Anyhow s2member should never have created a user for this not passed payment.

Stripe log:
A draft invoice for €20.00 to in_1MejSlJQmekOBFQgiISciMDC was finalized

2/23/23, 7:24:19 PM

A draft invoice was created

2/23/23, 7:24:19 PM

in_1MejSlJQmekOBFQgiISciMDC’s payment for an invoice for €20.00 failed

2/23/23, 7:24:18 PM

An attempt to fulfill the payment pi_3MejSmJQmekOBFQg0aWTYJ8Z for €20.00 failed

2/23/23, 7:24:18 PM

ch_3MejSmJQmekOBFQg0dICAXjJ’s payment for €20.00 failed

2/23/23, 7:24:18 PM

A new payment pi_3MejSmJQmekOBFQg0aWTYJ8Z for €20.00 was created

2/23/23, 7:24:16 PM

200 OK

A request to create a subscription completed

2/23/23, 7:24:15 PM

#2

Interesting. Did they get assigned to a paid level role or did they get added as free subscribers without access to paid content?

I noticed that using a paid trial to replace a setup fee is unreliable exactly because users are promoted even when their first payment fails, but this is new to me. :thinking:

#3

Paid role just as If the payment would have succeeded