Thanks, good info. My plan at this point is to whitelist accounts, because I want to try to keep from charging suspicious accounts in the first place.