PayPal has a similar problem: https://medium.com/@jewbixcube/paypal-allows-bypassing-two-f...