Hacker News Reader

Breach of ToS pretty much never entitles them to keep the money. They should at the very least bounce the payment back to the original payers.

No, because it's quite possible the "customer" is part of the "fraudulent action".