We had this happen with our donation plugin we used for my non-profit. We had at least a thousand attempts and 60 succeeded. Stripe was not helpful at all. We had to pay for RADAR just to make a rule blocking cards whose country of origin didn’t match the IP of the user – which stopped the attempts. This was obvious fraud and the RADAR per transaction cost total was more than what we took in legitimate charges. They charge $.02 per attempt.

The plugin was Donation Form Block for Stripe By GiveWP https://wordpress.org/plugins/donation-block-for-stripe-by-givewp/

Stripe investigated and said it was the GiveWP integration and that we should use a Recaptcha on the form. There is no free way of doing that and the one plugin that said it worked with Givewp – Zero Spam doesn’t work with the “Donation Form Block for Stripe” it only seems to work with the full GiveWP plugin.

We removed the plugin and went with the full GiveWP plugin and have not had any testing since then and we canceled the RADAR service.

Like I said blocking cards where the IP doesn’t match the user location or even allowing per country blocking should be part of the basic service but Stripe just wants to milk the fees