Xss with mail-in cards and OCR, cool