I saw a similar post on reddit about a week ago ( https://www.reddit.com/r/canada/comments/bgrl7n/canadian_mcd... )

From the top comment, speaking to support on the phone:

"He then admitted that the issue was that The App would occasionally load the wrong user's account, which was allowing people to purchase using someone else's CC."

If that is what is happening, maybe it is similar to the caching issue Steam had when serving store pages a year or two ago.