Thank you for looking into this in depth, you are correct, they prefer it different than it is now. I did expressly let them know that you guys would have followed their documentation. This is why they sent me all the details to provide you guys.
Unfortunately, this did cause an issue because it didn't create the subscription etc... so the user's next payment was captured but expired their subscription on our end because it never existed on Stripe's side
The security measure you're referring to was not when they initially signed up with us, it was after the issue occurred & then I had to ask them to resignup (never ideal for customers). During their re-signup, this is when the security measure apparently caused an issue. I found this to be ironic because the initial registration didn't have this problem.
So in addition to handling the subscription ordering, would you please make sure the security measures are in place (if not already). This one is specific to India apparently. Thank you!