> a bad actor using your site as a testing ground for stolen cards

Happened to me when launching a new site. Quickly refunded all payments, but still had to pay the fees.