I want to emphasize what I mean here:

If DIY HRT becomes associated with the same level of illegality as child sex abuse material, then you don't want to be buying that with your credit card. You want to be buying your HRT with the same money that people use to buy CSAM.

(I'm also increasingly worried about how credit card header data can be used, but that's a separate thing)