Can someone please tell me why we're letting payment processors control what kind of content we're allowed to pay for when tech giants are under near constant scrutiny for their moderation of user-generated content?
Stripe has pretty strict rules over prohibited businesses (https://stripe.com/us/prohibited-businesses). For example, here's their list of "high risk businesses", prohibited by their financial partners:
> Bankruptcy lawyers; computer technical support; psychic services; travel reservation services and clubs; airlines; cruises; timeshares; prepaid phone cards, phone services, and cell phones; telemarketing, telecommunications equipment and telephone sales; drop shipping; forwarding brokers; negative response marketing; credit card and identity theft protection; the use of credit to pay for lending services; any businesses that we believe poses elevated financial risk, legal liability, or violates card network or bank policies; any business or organization that a. engages in, encourages, promotes or celebrates unlawful violence or physical harm to persons or property, or b. engages in, encourages, promotes or celebrates unlawful violence toward any group based on race, religion, disability, gender, sexual orientation, national origin, or any other immutable characteristic
"Travel reservation services and clubs" bit me at some point, I wanted to build a flight reservation service and was surprised to hear I couldn't. But apparently, it's a high risk business because lots of people chargeback flight tickets.
Also, Gab completely fails that last criteria, they're not kidding anyone.
Oh I can't possibly think of a reason why someone would chargeback Alex Jones' Totally Legitimate Line of "BURN ALL YOUR FAT" products. Health & Wellness is a known high risk category.
> [...] firearms?
I'm talking about Visa and MasterCard. Banks have regulations to worry about.
I just skimmed it, looks like a good piece of investigative work. I don't see where you're reading they're "legit products", all the article seems to say is that they're not outright dangerous.
And this holds absolutely no value to payment processors, btw. Health & Wellness is a high risk category, period. I don't know why you think "but they're legit!" is even sort of relevant.
I also don't think that accusing MasterCard/Visa of 'funding terrorism' is a good rebuttal to this. Terrorists are probably better at evading the payment networks than legitimate content creators that want nothing more than to legitimately accept payments.
I'm sure you can find inconsistencies because other people/businesses are better clients, don't pain a target on themselves, and if they break rules they aren't so blatant about it.
Stripe (et al) could just require higher risk categories complete AVS and 3DS to be authorised. Card companies could also manually force out-of-band verification (SMS, email, etc) you can ask but guarantee the cardholder is the card owner.
Yeah that adds the requirement for two factor authentication with flexible out of band options, by September 2019.
http://europa.eu/rapid/press-release_MEMO-17-4961_en.htm
So yes, this further lessens the risk of "that wasn't me" when a significant-other checks the bank statement and sees a pile of porn purchases. That's the historical risk element of legitimate adult transactions.
Perhaps the card processing chain will relax after that.
There is more to the financial industry than credit cards. In the EU you have SEPA which basically allows you to charge a bank account like a credit card (though if you're high risk you'll need written consent from the owner).
This is about the chilling effect of regulator's behavior.
Compliance is expensive, hard, and detailed. And if you fuck it up, it can sting very badly. Financial companies get away with a whole hell of a lot in America, but they can still get very expensive fines, and whole departments exist to mitigate this risk.
Financial software engineering is precisely as poor as you think it was. In 1985. Forget the scary stuff they build on purpose. The real fear is the scary stuff you didn't realize you built until an auditor finds it.
You don't ever want to do the kind of thing that causes an auditor to say "let's examine this closer", even if that thing is ultimately legal for reasons X and Y. You want the system to pass inspection with the minimum amount of scrutiny.
Being genuinely compliant for many types of nuanced clients is great. But it's a lot cheaper, and a lot safer, to be strictly compliant for limited types of generic clients. When you support services like this, you put a target on your back[0].
Mastercard and Visa are like Palantir. They're not innocent, but they're single nodes in a large machine that you'll never hear about because it doesn't interface directly with the public, and so they get all the shit because nobody knows where else to send it. Payment processors like FIS, the many institutions that issue cards through the card companies processed by the processing companies, they all have their own shaky infrastructure and compliance fears. No one org decides to shaft the public. They're all covering their asses. As a result, the set of industry best practices converges on the safest common denominator.
You want them to risk millions in fines and investigation that unearths more skeletons so you can host gifs of boobs? Through services where margins are measured in basis points? Good luck.
TLDLR: Visa and Mastercard are following orders from America, and behaving sanely given a corporation's fiduciary duty to not die. The correct place to attack this is with regulation that mandates equal access. Or better yet, blind access. Again, good luck.
I imagine your alternative is some cryptocurrency that becomes worthless as soon as people stop running the nodes. Yeah, that definitely has less risk than a legal financial entity backed by the United States Government.
Capitalism: It's a free country. Don't like it? Start your own business.