Vendor and transaction IDs (and other irrelevant keys/values) seem to be the way he thinks a declined payment is logged/charged. My guess is that it’s also linked to a fixed IP. I’ll take a deeper look at it later.