To upgrade you should need to insert your password to avoid being chargedback by unknown players.
The are ups and downs about this. For example someone will not be able to buy a rank for someone.
But this will savealot of time for NoobCrew and CypriotMerks.

Post below and tell me what you think about this.

 

This is good because it may help from random chargebacks like you said.

 

Incorrect, they only see the IP addresses which is simply disguised using a VPN.

 

oh.

 

But how would buycraft know if you put a random password in

 

This isn't something they have control over. That would require cooperation from Mojang and Buycraft to use Mojang's database to assure the password is correct and matches the username to the letter. Also, this would mean if you wanted someone to upgrade you, they'd need your password. Should be obvious why that's not a good choice.