Stripe payment processing circumvention

I have a friend who runs a high-risk site, but he uses Stripe on it..

I know that Stripe would NEVER allow this kind of site on their network, but he's deploying some kind of black-hat technique to pull it off.

I don't want to ask him how he does it for various reasons.

From what I can tell, it has a PHP script that acts as the payment form, and its actually validating the card as well with creditCardValidator.js

It looks like he's doing something with a charge.php file that might be sending different info toward stripe, that exposes to themselves as a white-hat domain.

On the network tab of dev tools, it looks like this:




Not sure if that's helpful or not ..

But I know that when you analyze this on a normal stripe payment capture page.. there are several network calls directly to stripe..

but on here it's only ONE, with a request URL of their site ... Which is what I just showed you above.

If anyone knows how to pull this off, I would be very grateful

The thing he doing is commonly known as cloaking. At the time of checkout you're directed to a new landing page and order is placed to some product that is accepted by all.

Yeah @SteveHolt like @luqman50 said it is basically transaction laundering. he is probably using a clean domain to host the backend and handle the API calls so stripe only sees the whitehat site traffic. honestly though stripe radar is insanely good at catching this now... they track browser fingerprints, IP mismatches, and sudden spikes. once they catch on they freeze all the funds and blacklist the merchant. not really worth the headache imo, better to just find a proper high-risk processor.