Videogameplus is notorious for having awful security for their payment pages and not giving a fuck/denying that fact. A ton of people (including myself) have had a bunch of fake charges on our cards after a set number of months. The shared pattern: Every one of us used our card on VGP, and all of those fraud charges happened approximately the same number of months after the VGP purchase (likely to divert suspicion of source).
Don't know if it's fixed yet or not (happened to me when I bought Valkryia Chronicles Remastered for PS4) but it's enough to make me not want VGP to even be advertised or promoted by this thread, the discord, or either game deal twitter account. Even with a Paypal-only warning.