I wonder how the people handling the requests deal with the issue of whether inquiries are real or jokes (if customers ask for something extremely unusual or extremely expensive).
You have to hook up your credit card and pay for things as they're ordered and before they're delivered.
So the only real risk is the someone uses a stolen credit card when they first sign up.
Between some sensible prudence on Magic's part (limit transaction size for new users) and the banks' own fraud detection systems, the risk seems quite manageable.
I guess I'm also wondering whether they have to worry about offending or angering the user by misjudging whether the user is joking -- not just about the financial risk to the company.