Got scammed - have their "full access" Stripe key (want to f.. with them)
Hi all.
My wife got scammed yesterday by a site claiming to sell Le Creuset kitchenware.
It has been 25-30 years since I was into these things, but after some research and AI magic, I got enough information about their scheme to prepare a complaint to the credit card company.
Then I realised the idiots had revealed their sk_live key, which gives me full access to their Stripe account through their API.
I try to stay on the safe side and on the right side of the law, but couldn't help researching a little bit what I could do with this key.
I've done some dry-run refunds, and it works.
I ran a report, and in the last 30 days, they have had a net income of approx 37,000 USD on this account from more than 400 orders. And they run several front/shell companies. It's documented in my research.
In short, they have an online store in an European language, "selling" popular goods. When people order anything from them in good faith, the order is sent to one of several different merchants registered with Stripe.
I am going to report my findings to Stripe, the police and other authorities, but I would love to scam the scammers first. But I don't know how to do it without putting myself at risk.
Successful refunds can't be stopped, according to Stripe, so wouldn't it be wonderful to refund as many transactions as possible - give the scammers money back to the buyers' cards? A little Robin Hood-vibe?
Any thoughts?