Note that in the case of Stripe, the site doesn't hold onto "financial information" per se - they hold onto tokens where Stripe is the holder of the information, and they can't access the card number or CVV after it's been sent to Stripe - so all fraudulent transactions would have to be requested through that Stripe account.
They shouldn't have access to card number and CVV either way because usually they are not PCI-DSS certified. Stripe handles that in an iframe (requirement of PCI). CVV cannot be stored at all even by Stripe.
