Update
Update - fast track have tried to remove my review saying “I have the wrong domain”. I do not, and have the screenshot to prove it.
Immediate credit card fraud happened…
Immediate credit card fraud happened after booking via this website.
Used a brand new card, first service i used with it and I had a whole heap of fraud transactions on my card an hour after
To clarify:
I used my card only once that day — on your website.
Within one hour, multiple unauthorized charges were attempted using that card.
No other websites, merchants, or apps were involved, eliminating other potential sources of compromise.
Update - in response to reply
Seems like a very stock response. while technically “you may not store my card,” that doesn’t mean the site is secure or that card data wasn’t intercepted en route.
While you state that your website uses industry-standard encrypted gateways and that card details are not stored, my experience, combined with a technical review of your platform suggests there's probably a deeper issue worth immediate investigation.
Given this, I took the time to analyze your site infrastructure. Here are several observations that raise red flags:
No Visible Integration with Trusted Payment Providers
There is no sign of established gateways like Stripe, Adyen, or PayPal. If you are handling card input fields directly or passing card data through your own backend, this introduces serious PCI compliance risks.
Potential Frontend Vulnerabilities
Your site is built using Nuxt.js, which dynamically renders JavaScript. If any of your internal scripts or third-party libraries (e.g., Zendesk, SweetAlert2) are compromised, they could easily capture form input — especially card numbers — before submission.
Lack of Clear Payment Security Practices
Your public-facing code does not indicate the use of PCI-compliant input tokenization (e.g., iFrames or hosted fields from your processor). If card fields are rendered directly on your domain, any script running on the page could have access
Reply from Fasttrack
Dear M T,
Thank you for taking the time to share this feedback. We take any report of potential card misuse extremely seriously, so we conducted a full review of our payment system, and the specific checkout flow you used. Our checkout is powered entirely by Stripe’s PCI-compliant payment infrastructure. Card details are entered into secure Stripe-hosted iframes that are isolated from our website by the browser, which means that neither we nor any 3rd party script or attack can ever see, handle, transmit, or store card numbers, expiry dates, or CVC codes at any point. Nothing in our system indicates any form of compromise, interception, or unauthorized access. We understand how worrying card fraud can be and we do not dismiss your experience in any way, but based on the data we have reviewed there is no evidence that the issue originated from our platform. If you would like us to share our findings with your bank or provide any further documentation, our support team is here to help and will gladly assist you directly.