Bloomburg:

It’s unclear exactly when Kvashuk stumbled on the gift card glitch in Microsoft’s security system (which the company says has since been closed). But at some point in 2017, around the time Microsoft recruited him for a full-time, $116,000-a-year engineering position, he gleaned that his team’s experimental accounts were programmed only to prevent the e-commerce site from shipping fake purchases of physical goods: PCs, tablets, keyboards, and so on. Microsoft simply didn’t intend for its digital-retail testers to order Xbox gift cards on the job. Kvashuk could have reported the vulnerability to his bosses, but he took the red pill instead.

This is a fascinating read, a real insider con story.