In reply to trentlapinski.

This is a practice that credit card thieves have been using for a long time. Any credit card processing form that they can write a script for is in danger of having this happen. Probably not an active WordPress community member involved. That does really suck though, a site I managed went though something similar about 4-5 years ago.