Stripe is friendly to "friendly fraud"

(gingerlime.com)

143 points | by gingerlime 2 hours ago

19 comments

  • zuzululu 1 hour ago
    My suggestion is to just ban specific regions or countries and you can cut 80% of this fraud.

    I'm not going to name those countries outright but you should never ever be launching globally until you have these safeguards in place.

    Once you are known to be vulnerable to a certain scheme, it quickly becomes known in that region/country.

    Again and again I'm reminded why high trust societies remain high trust and why low trust societies rarely transform into high trust society.

    • shash7 7 minutes ago
      I've got 13 chargebacks over the last 4 years for my biz. Out of these, 10 came from US based cards. The other 3 came from Australia(my country).

      Be careful when taking verbatim advice from internet strangers.

      • esseph 6 minutes ago
        [delayed]
    • Cider9986 53 minutes ago
      Accept crypto for those countries, it doesn't have chargebacks and helps those vulnerable to the financial system.
      • epestr 9 minutes ago
        I went down a bit of a search looking for counter evidence that crypto is likely less available to them, and it turns out both perspectives are true depending on the scale you look at. At the micro-level, survey data from emerging markets[0] confirms that crypto offers immunity against institutional failure and inflationary currency.

        But this QJE article[1] argues there's a ceiling to how far things scale. Concluding that the cost to keep a decentralized network secure scales with its total economic value. So while there is immediate value to it's user, it might not scale well, and can't replace a country's financial system anyway because securing it at a sovereign scale would just be more expensive.

        [0]: https://www.mdpi.com/1911-8074/17/10/467 [1]: https://academic.oup.com/qje/article/140/1/1/7824430

      • shimman 22 minutes ago
        Man people are still using the "it's a currency" grift when discussing crypto, did the El Salvador failure really teach you nothing?

        https://en.wikipedia.org/wiki/Bitcoin_in_El_Salvador

        • OneDeuxTriSeiGo 7 minutes ago
          That's less because it was Bitcoin and more because the entire effort was a slapdash affair pushed by Bukele in an effort for him and his buddies to profit off the cryptocurrency boom rather than being an inherent knock on cryptocurrency itself.

          Also of all the cryptocurrencies Bitcoin is a pretty poor choice since it could be pretty well argued that it has lost the original purpose and devolved into a raw "line go up" financial instrument.

        • koolba 7 minutes ago
          Crypto does have the distinct cash like advantage of not having chargebacks. I don’t know of any other digital payment system with that property.
    • edflsafoiewq 31 minutes ago
      > I'm not going to name those countries outright

      Why?

    • OneDeuxTriSeiGo 20 minutes ago
      > I'm not going to name those countries outright

      Why?

      > Again and again I'm reminded why high trust societies remain high trust and why low trust societies rarely transform into high trust society.

      Oh. Racism that's why. Yeah you want to ban low trust societies then you clearly need to ban the US and Japan as well (both sitting well under 50% on the trust index). Or did you mean something else when you said "low trust"?

  • danpalmer 12 minutes ago
    This is just fraud.

    "Friendly fraud" is accidental or with the correct intentions – such as the customer not recognising the charge and charging back.

  • shash7 1 hour ago
    I run a saas and we get this every now and then.

    As a rule of thumb, when you get a chargeback you need to completely ban the customer from your db. This includes:

    - card ban - email address ban - fingerprint their access and ban

    This will save you a lot of hassle when they try to signup/buy your product again and cause you the same amount of grief.

    • epa 50 minutes ago
      Exploiters easily get around this. its a small group of people doing all of the abuse.
    • Cider9986 47 minutes ago
      All 3 of those identifiers can be easily changed by advanced users. I'm curious what you mean by fingerprint their access. Is this like an on demand fingerprinting, I've only seen browser fingerprinting as a tracker for every user.
    • wahnfrieden 1 hour ago
      Use DeviceCheck if iOS app too. Uber does this to ban across accounts
      • Cider9986 46 minutes ago
        I imagine most fraudsters wouldn't be using iOS. I'm curious if the android app fingerprinting solutions go cross user profile.
    • shawnz 1 hour ago
      You'd better be promptly responsive to legitimate customer support inquiries if you are going to have a policy like that
  • nostromo 37 minutes ago
    The customer screwed you over, and then their bank did too. Stripe didn't. I'm not sure why Stripe is getting blamed in the title and the article.

    Yeah, maybe Stripe could do more without Radar, but I imagine it could also be fraught if Stripe was in the business of blocking customers from their entire network based on one vendor's complaint. Obviously a lot could go wrong with such an approach.

  • varenc 1 hour ago
    > They told me they don’t use evidence of chargeback abuse from one merchant to create cross-merchant fraud signals, or to take action against the customer’s card, email, or other details for other merchants.

    I'm surprised they were able to get Stripe to actually state all of this clearly. It's nice that Stripe actually communicates details like this. But you can see the logic behind why many other big companies would just respond with an opaque message like "thank you for your report, it will be handled in the appropriate manner". Because saying the truth gets people more upset.

    • nathanmills 28 minutes ago
      No, vagueness gets me much more upset, but there's just nothing to write about in those cases.
  • sbierwagen 2 hours ago
    Stripe obviously records data around friendly fraud, (At minimum they implement Visa Compelling Evidence 3.0 https://support.stripe.com/questions/how-does-stripe-support... ) and since you did not include screenshots of the messages sent by Stripe support I suspect they were saying something carefully noncommittal and legally compliant to get you to go away, which then got spun into an outraged blog post.
    • Dylan16807 1 hour ago
      > I suspect they were saying something carefully noncommittal and legally compliant to get you to go away

      If their total dismissal of the problem is itself deception, that's not a particularly big improvement!

      • SpicyLemonZest 25 minutes ago
        The problem is that, as patio11 once described in detail (https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...), there are genuine tradeoffs here that people get outraged by the mention of. How many legitimate sales should Stripe block in order to more effectively fight this kind of fraud? Merchants don't want to hear it, and consumers don't either. So financial companies invariably conclude that it's better to raise the question only in careful, indirect ways which could not be misinterpreted as a statement that fraud is good or OK or acceptable.
    • 8cvor6j844qw_d6 1 hour ago
      > Stripe obviously records data around friendly fraud

      My only nit with Stipe is they don't allow me to delete card details for an ongoing subscription I don't plan to renew and already set it not to renew on the service billing page.

    • benoau 1 hour ago
      That link says the customer's undisputed transactions 4 - 12 months ago with you may establish their disputed transaction was actually legitimate, but the article is about someone who only made disputed purchases within a week or two.
    • bfkwlfkjf 1 hour ago
      What's your point? Do you think it matters what stripe said? What is something that they could've said that wouldn't have justified the outraged blog post?
      • SpicyLemonZest 1 hour ago
        The author thinks it matters what Stripe said, since they chose to use it as the title for their blog post. To the extent that it was just meant to be a lament that it's hard to be a small online merchant in an era of strong consumer protections, sure, I sympathize. But they seem to think it's a problem with Stripe that could be fixed if Stripe behaved better.
  • bberenberg 1 hour ago
    I got hit with a fraudulent chargeback (claim was the purchase was unauthorized and the person showed up in person to a class) and it was doubly bad because they paid via Link which means that Stripe actively verified them via 2FA.

    Can someone explain to me why Stripe (or a competitor) doesn't offer a setting "refuse transactions for cards that have filed > x chargebacks with <acquirer> merchants this year"?

    • cperciva 1 hour ago
      claim was the purchase was unauthorized and the person showed up in person to a class

      Certainly a person showed up in person to a class, but how do you know it was the person whose credit card was used?

      • bberenberg 1 hour ago
        It matched their LinkedIn photo.
        • jagged-chisel 1 hour ago
          I didn’t realize LinkedIn photos were a legitimate form of identification. Good thing they can’t be faked or changed readily.
          • esseph 3 minutes ago
            [delayed]
          • mattmaroon 45 minutes ago
            Do you imagine someone got a stolen credit card, made a linkedin with that name, used the card to attend a live class under the fake ID, or are you just doing the classic hacker news aaaaactually?

            Comments like this have ruined this site. We all know that’s never happened once in history.

            • lunchbucket 26 minutes ago
              If you care about the quality of the site, consider the guidelines about not responding to a bad comment with a worse one and not griping about how HN has gotten terrible or turned into reddit or what there you. Downvote, flag, and move on to better discussion, and you'll spend a lot more time engaging and contributing to good discussions.

              Contributing to good discussions is the highest leverage way to promote the quality of the site. Spending time in poor discussions is what makes it feel like HN has gone to crap.

    • mriet 1 hour ago
      Their business model is to allow as many possible "valid" transactions, not to serve their "clients". They're a PSP...
    • SpicyLemonZest 1 hour ago
      I don't know this is the reason, but if I were asked to build such a system, I'd be pretty worried that it constitutes a consumer report under the terms of the Fair Credit Reporting Act.

      Certainly I wouldn't want the inevitable news drama about it. "I'm just a poor innocent grandma, I'm a trusting person when it comes to Facebook ads, and Stripe punished me for getting scammed by banning me from half the stores on the Internet!"

      • AnthonyMouse 36 minutes ago
        If your card is actually stolen then you should have the card number changed to prevent additional fraud and then the disputes would be against the old card number rather than the new one, right?
        • SpicyLemonZest 19 minutes ago
          If your card is stolen you should, but not necessarily if you fall for a Facebook ad that ships you a pile of rocks or a paper photo of the product you thought you bought.
  • phonon 8 minutes ago
    Use EMV 3DS 2.x authentication with liability shift protection?
  • Suppafly 23 minutes ago
    You know enough about the buyer to sue them or report them to the FBI.
    • tonyarkles 19 minutes ago
      Suing someone in the Philippines probably won’t be worth the effort for an $18 product. And the FBI probably will not care much about a $18 international fraud.
  • ValentineC 1 hour ago
    There aren't any screenshots of conversations with Stripe support in the blog post, but I'm guessing one other reason is that support agents are incentivised to close tickets or end conversations as quickly as possible.
  • stego-tech 54 minutes ago
    At this point I’m fairly convinced Stripe is Paypal 2.0, at least in spirit:

    * Turns a blind eye to misdeeds on its platform

    * Locks out adult creators/vendors after taking their money

    * Is ubiquitous, but not well liked

    I love that Stripe changed the game of fintech and made it accessible to more parties in a programmatic way, but I find myself repeating “avoid Stripe” to a lot of folks asking me for advice on dealing with payment nowadays for those reasons.

    • gyomu 39 minutes ago
      That’s just the nature of these industries.

      1) Incumbent is slow, clunky, unpleasant to deal with due to years of accumulated constraints to deal with

      2) Newcomer can differentiate themselves by being nimble and pleasant to work with, taking market share

      3) Over time newcomer has to deal with increasing amount of scrutiny, fraud, overhead, CYA type practices, etc

      4) Newcomer is now incumbent, goto 1)

    • mattmaroon 50 minutes ago
      Who do you recommend as an alternative?
      • stego-tech 39 minutes ago
        I don’t have one at the moment, at least for my circles (artisans, craftspeople, adult creators in general). Much of it has fallen back on PayPal for folks without an LLC to hide behind, or Square if they’re incorporated as a business. The trick has been discretion and operating in a gray area: “novelty goods”, “graphic design work”, and “outerwear” as item descriptors or db entries, obscuring the actual content without actually lying or deceiving the payment processor.

        Most paypros, most of the time, won’t look too hard unless there’s a problem or you’re tripping some internal security measure (like raking in a lot of cash in weird amounts). Of late they’ve been more intrusive due to some weird eTeen puritans, but that’s quieting down again as they remember they like making money, and throwing legal content off their platforms can very quickly cause an exodus of customers looking to avoid having their funds seized.

  • NDlurker 1 hour ago
    So I can crack open a Backwoods, stick my weed in there, and then glue back together with Ciglue? That's pretty cool.
  • ios-contractor 1 hour ago
    To be fair, from stripe's point of view, how would they know that you and the alleged customer are not in on it for some reason they don't know?
    • AnthonyMouse 25 minutes ago
      "Friendly fraud" is when the cardholder is in on it. They or an accomplice they've given access to their credit card go to a merchant, order and receive an expensive item with the card and then file a chargeback claiming they didn't make the purchase so they can keep both the item and the money.
    • wildzzz 17 minutes ago
      What would be there to gain? The merchant loses money to the credit card processing fees, chargeback fees, and shipping cost along with the loss of the product, they gain nothing. Its a pretty expensive way to send a customer a free thing.
    • jellomjello 1 hour ago
      ? in on what?
  • hdndjsbbs 1 hour ago
    I had a customer do something similar with a thousand-dollar product. They had signed for delivery and provided no evidence, but banks always side with the customer.
    • Cider9986 50 minutes ago
      I thought that banks were less likely to side with the customer compared with credit cards.
  • tptacek 1 hour ago
    Isn't this a property (and longstanding value judgement) of the entire payment card ecosystem?
    • AnthonyMouse 23 minutes ago
      When a problem is industry-wide, people are naturally going to complain about the most prominent companies, but that's not necessarily even wrong. The most prominent companies are the ones in the strongest position to actually do something about it (e.g. develop better detection for friendly fraud or lobby for sensible regulatory changes), and have a stronger incentive to when they're the ones who keep getting blamed.
    • tonyarkles 16 minutes ago
  • bix6 52 minutes ago
    Signifyd (company) solves this issue.
  • dentemple 2 hours ago
    Then what are the better alternatives?
    • bombcar 1 hour ago
      Nothing, it’s a 5% bobcat problem. The card processors can force the merchants to eat it and there’s nothing you can do save not accepting cards, which loses you the other 95% of the market.

      https://xkcd.com/325/

    • Cider9986 51 minutes ago
      Monero or honestly any crypto. There's no chargebacks and it can be more private.
      • wildzzz 10 minutes ago
        That's fine for some things but my grandma is not going to buy from an online store that only takes crypto. Crypto as a payment option works well for computer-related merchants or for privacy-focused merchants. Like it wouldn't be uncommon to rent a VPS with crypto but it would be strange for an online candy store to accept it.
      • N_Lens 16 minutes ago
        Don't most crypto exchanges ban Monero?