Would suggest using webhooks to customize and trigger alerts (https://stripe.com/docs/webhooks), or turning on payment notifications (https://support.stripe.com/questions/set-up-account-email-no...).

But the best way to prevent this is to absolutely make sure secret keys are kept secret! We try to scour for leaks in the wild—and notify the owner directly—but can’t see everything.