From the top comment, speaking to support on the phone:
> "He then admitted that the issue was that The App would occasionally load the wrong user's account, which was allowing people to purchase using someone else's CC."
If that is what is happening, maybe it is similar to the caching issue Steam had when serving store pages a year or two ago.
The internet has been retelling some version of this story forever: company system screws paying customer, and company refuses to help or even admit a problem.
[0] Canadian debit cards are secured through chip and PIN, and the number on the front isn't a secret. You can use things like online bill pay or Interac e-transfer (which is not really used by businesses), and some banks allow you to create a virtual Visa card that's attached to your chequing account, but debit cards themselves are physical tokens that can't be used online.
