Hacker News Reader

Comment by Silhouette | Hacker News Reader

This looks very promising. Stripe seems to have sometimes let surprising payments through up to now, even with all the card details security checks they provided activated, and they've never supported 3-D Secure. They've also suffered from surprisingly high rates of unexpected declined charges in our experience. Hopefully if they're now rolling out more comprehensive fraud protection, that will go some way to addressing all of those concerns, so best of luck to them with this new development.

Edit: It appears there's a small per-transaction charge for their enterprise customers on custom plans but it's now included for free with the standard pricing. Can anyone confirm this?

View on HN

We had the same experience, unfortunately most of stripes "declined" charges are actually declined by the bank and stripe cannot, nor is willing to help you out. They are just a gateway. Once it happened on my own site with my own card, I called my bank's security team and asked what is the exact reason on their side and all they could tell me over the phone that they declined the transaction only because it was too "high risk"

My theory (just a theory) is:

A. banks fraud detection systems just don't like the way stripe is avoiding the whole merchant account game, so stipe just has a bad rep at banks

B. stripe is so easy to set up and use, therefore various stripe websites has fraudulent transactions going on, so from the bank point of view just being a new merchant coming through stripe is automatically high risk

The whole machine learning for fraud detection imho is very annoying from a merchant point of view, because there is no real way to fix it. We have had cards that got declined only the second-third month in a rent-to-own business and the only thing we can do is to ask the customer to call their bank.

Hopefully once fraud detection happens at the stripe level instead of the bank level, banks will see less fraud coming from stripe and the overall decline rate will ... decline.

Agreed on pretty much all of that. We too have wondered whether the ease of use that makes Stripe so attractive to a small business might also induce some sort of penalty in terms of fraud checks by other organisations. If that really is the case, presumably it leaves Stripe in a tough situation, but this seems like a responsible and hopefully effective step on their part.

We see quite a lot of failures on the second month of a subscription, particularly for customers abroad (we're in the UK). We also tend to see these sort of failed charges happen in waves, with few problems for a while but then a sudden spike in declined transactions. That suggests at least one plausible explanation: the lack of CV2 after that first charge may be enough to tip something over the edge into "too suspicious" territory following some sort of update in the overall scoring scheme used by whoever is blocking the charge.

We're looking into various potential ways to improve the situation, such as allowing more automated retries of failed charges over a longer period before we give up, and possibly advertising prices in our customers' local currencies. However, each of those has some potential downsides and obviously there is only so much you can do as the merchant anyway.

If Radar can start to make Stripe, and by extension its merchants, a harder target for for fraudsters, maybe that will also move the needle a bit. A few times I think we've lost more subscribers in a month to failed card charges than everything else put together, including customers actively choosing to cancel and including failures via all other payment methods we accept, so it's definitely an issue worth exploring.

(just saw your edit) Radar is included for the vast majority of our users who are on the standard rate. If you're an enterprise customer on a very custom plan, there's a small per transaction fee.

> they've never supported 3-D Secure

That's a feature. It's a horrible system which I wish nobody ever used. I've literally never been able to successfully complete a transaction.

It's not great in many respects, but it has the compelling advantage of shifting fraud liability from the merchant to someone else. Depending on your market, it may be worth the loss in conversions from activating it.

Even if you're in a normally low-fraud market, as every business I work with that takes card payments is, almost anyone taking small value card payments on-line is vulnerable to being used as a card testing engine if their system can be automated. If nothing else, being able to toggle the extra check on temporarily if you become aware that your system is being abused that way is an extra level of security you can apply in a hurry.

I've experienced 3D secure and verified by visa effectively insulating a merchant from chargeback risk (I'm talking 99% success rates winning chargebacks). You're right, it is incredibly user-hostile and truly painful to integrate (as compared to Stripe) but if you're in a business that sees a lot of people trying to rip you off it works wonders.

It works wonders in eliminating chargebacks by also eliminating legitimate customers?

Fewer customers but a lot less fraud could very well be the more profitable and safe option.

Perhaps, but it's important to actually run that calculation. After all, shutting down web payments entirely would totally eliminate fraud—but also cripple your business in the process.

Personally, I will never use a 3D Secure system these days. If you require it, I'll simply skip purchasing.

You only display it to risky customers?

In addition to what everyone else said there are big regional effects: in North America cardholders have often never seen 3D Secure before, they don't know their passwords, and issuers don't care enough to make their authentication pages usable.

But in France and the UK it's pretty standard; cardholders are used to it, and issuers make an effort to decide whether it's worth requiring authentication.

Which bank are you with? Every bank in the UK seems to have a different implementation of it. My own bank just does some automated fraud detection (I assume picking up my IP address, browser details, etc), while a friend's bank requires the user to enter three random letters from a passcode.

(I work on Radar at Stripe) thank you, and do let me know if there's anything we can do to help you get set up on Radar. Additionally, we actually do support 3Dsecure in private beta -- mind emailing me (tara@stripe.com) for access?

Please please please promise that it will always stay optional?

From playing around with it a bit, it appears you can disable any and all rules, if you want.

Thanks for the reply.

Ironically, we probably have much less interest in 3-D Secure if Radar will now let us deal with the same "sudden spike in dubious sign-ups" problem anyway.

One interesting possibility might be if the kind of rules you allow for Radar could be used to determine whether to apply 3-D Secure if it's available, so we could enable it selectively for countries where people don't already have a zip/postal code to verify for example.

However, for my own small businesses, I suspect we'll be more interested in what Radar can do, particularly to add immediate extra security checks if we are suspicious of a pattern of requests from a certain part of the world.

Reply on news.ycombinator.com