I'm convinced this is how some of the payment gateways make their money.

With one gateway after we switched providers and took the interface out of production we received about 5 fraudulant payments in the month that followed. Someone had hacked the bank's "iframe" service that we did not use and even though we only had the account open for a potential rollback we were still liable for $20 x 5 in fees. It was entirely the bank's fault.