Mastercard will stop free trials from automatically billing once they're over
newsroom.mastercard.com
newsroom.mastercard.com
Thank you MC for raising the bar for other CC brands.
MasterCard is making an awesome first step here. The next step is to insist that companies must let you cancel subscriptions online, just like this California law: https://www.cnet.com/news/companies-must-let-customers-cance...
https://www.cardbenefits.citi.com/Products/Virtual-Account-N...
https://www.bankofamerica.com/privacy/accounts-cards/shopsaf...
Now such gift cards aren’t perfect — you have to pay a bit extra, but for the purpose of signing up for a trial period with any company that automatically turns your trial into a subscription and which is known to make it difficult to cancel the trial it might be a good idea.
However, before even signing up for a trial with a prepaid gift card one needs to be sure that one is not entering into an agreement that legally binds you to a subscription.
I recently bought a prepaid gift card that I intend to use for a 7-day trial with a company that is known to make it difficult to cancel. But I will only sign up for the trial if the automatic subscription is not legally binding.
This gets to the heart of the matter: it shouldn’t be possible to sign up for a legally binding automatic subscription for a pure service. Customers should have the liberty to leave at any time without incurring a fee.
If I can sign up in under a minute I ought to be able to leave in under a minute.
There was a period between the old expiration and the new issue and not common, but it did happen from time to time.
I'm sure you've seen the idea that an upgrade to IP could have just added another octet or two and changed nothing else. It would have worked pretty well to prevent us running out of addresses, with 40 or 48 bits.
Well, 16 digit credit card numbers are a hair under 50 bits. And full-size 19 digit credit card numbers are a hair under 60 bits. That's plenty. You can give out a million of them to every person. If we couldn't reuse, they would eventually run out. Because we can, they won't run out.
Then factor in that CC numbers have an ~2year expiry date and a 3 digit CCV number, so old numbers can easily be reused.
Further the name of the holder could be added as a key to the number, further increasing reuse.
We won't run out of CC numbers anytime soon.
Based on wikipedia [1], the first 6 digits are used to identify the issuer (although from looking at this listing [2], it appears to be standard practise to assign some institutions blocks of IINs, and given that an institution could control multiple IINs, it is probably relatively safe to consider these to be part of the unique card ID. When we start to run out, we will probably see a market for these emerge in the same way we see a market for IPv4 subnets today.
The only area of fragmentation where I see potential trouble for secondary markets is the first digit, which is restricted by industry (banking only has 4,5,6); but if it ever becomes an issue, I am sure they will re-purpose the address space of other industries for banking
This leaves only the checksum digit itself of deeply problametic for maximum utilization; and that is literally a single digit.
[0] I wish this were a joke. https://webstore.ansi.org/Standards/ISO/ISOIEC78122017
[1] https://en.wikipedia.org/wiki/ISO/IEC_7812
[2] The official listing is not publicly available https://www.bindb.com/bin-list.html
It would of course require a massive amount of work across the board, so it's very unlikely to happen.
It's true that the number of organisations that interact with the message formats for sending card transactions is significantly smaller than other things, but we're talking about every single bank, every single PSP, every single embedded card device, and probably many more organisations beyond that, currently in operation today. Given the glacial pace of most banks' IT operations I would not expect them to do be able to achieve this within a time frame of several years or perhaps even a decade.
Sure these are not the same challenges as IPv4 and such, but it is in no way a trivial change to tweak a message format that has been in use since before most HN users were born :)
And it really should be enough. With 10^18 numbers you can allocate 1000 numbers per day to each of 10 billion people, and go 10 years between reusing numbers, and still have only a few percent of numbers reserved at any point in time.
Also CVVs won't match even if you reuse the number
I contacted the bank, and they said if the charge was not fraudulent (1), there's nothing I or they can do. Apparently the merchants can back-date transactions like that to a time when you interacted with them and the card was valid; I'm not exactly sure how they can charge an empty debit card though, but apparently they can do that too (because they pre-validated that I had a certain amount at the time of rental?).
(1) It wasn't; the contract said that they can do that, and I actually could use a ticket reference number that they quoted to verify on the police site that there was indeed a parking ticket issued to the car on the day that I dropped it. To this day I'm not sure if it was me who committed a parking violation, or the next person who rented the car, after me. It is mildly plausible that it was me - that morning I parked in a legal parking space, but slightly outside the allowed "lines" (another car was taking a third of the only remaining slot, and I parked a bit outside of it).
One of them ("Authorization") is about verifying that the payment has been authorised by a cardholder, and is there to protect the issuer against fraud by their own cardholder and perhaps if you squint, to indirectly protect you from thieves. This has been the focus of technological innovation, up to and including EMV ("Chip and PIN"). It's also completely optional, most cardholders have no idea that's the case.
The other mechanism ("Settlement") is about taking money from the cardholder's account and putting it in the merchant's account. This is done entirely on the honour system, always has been, probably always will be, none of the technological improvements touch it significantly. It's mandatory in the sense that without it the merchant can't get their money.
Avis doesn't need Authorization to get your money, they only need Settlement. And like I said, it's on the honour system. Any merchant in the system can just tell the card network "Hi, card number X gave us $418.26" and they'll get $418.26 of X's money in their account. No need for any other steps.
Now, if you dispute the transaction the issuer _might_ say, well, wait, how do we know they agreed to pay $418.26? And then Authorization matters, the Authorization can prove somebody swiped a card, or typed in a PIN, or whatever. Without Authorization the issuer might choose not to pay. But there's no guarantee as you found, unless a government regulation forces their hand why should they care - it isn't their money?
This reliance on the honour system means that e.g. even though EMV has anti-replay features that mean Authorizations can't be re-used about once a year or so in the UK you'll have a news story where some big merchant like a supermarket or fast food chain will double charge all card customers for a day. What happens is the Settlement data just gets accidentally run twice, maybe it's a physical magnetic tape, or a backup copy of a file, or some new server boots up and re-runs yesterday's Kafka stream. Settlement has no replay resistance so even though all these transactions are duplicates that goes undetected until customers start phoning up angrily and their bank realises what happened.
To a first approximation nobody checks Authorization. If you wanted to be an asshole you could try it out, ask your bank to reverse a random fraction of all your transactions. When you get a bill, pick some at random, phone the bank. Insist those are bogus and you've never heard of them. In most cases the vendor has no usable Authorization records and will just write it off, they were entirely reliant on getting paid on the honour system. Obviously if you're unlucky you'll pick someone who can prove you owed them money and is angry about it, so you may not want to try this after all.
You might think this situation is crazy but it's more common than you realise. There have been a lot of grave problems with SSL/TLS over the years. But there aren't many examples of actual consequences in practical terms. Mostly it seems as though there actually aren't bad guys trying to break your secure communications, so even if it would be possible they didn't try. Huh.
How about the case I mentioned? If I told the bank "I did not authorise Avis, would Avis have been able to somehow "prove" that I authorised the transaction (I obviously didn't; the card was expired when they charged it; but I did have a signed contract with them, is that enough to directly take money from my account? Feels like it shouldn't be enough, not without a court getting involved).
Whether the bank has to take your side will depend on law where you are more than any technical facts. That signed contract is going to be a factor, and you giving Avis the card (even though months before and without expecting to pay this) would probably matter too, I'd be surprised if the issuer or the law was OK with something like "We found this card number on an unrelated payment from years ago so we charged it".
I mostly think this should be "fixed" to be stricter, but let me briefly take the merchant's side. Suppose I check out from a hotel one morning. $120 for one night sir, thanks for staying with us. Two hours later cleaners find the room is trashed. I've ripped up the carpet, a chair is in pieces, the wall TV has been attacked with a knife. Why the hell shouldn't they be able to try putting it on my card? Should my bank really refuse if I have the money, and force them to take me to court to try to get their money just because I didn't authorise the charge? Realistically it's not in anyone's interest to insist on that except bad actors.
Yes, absolutely. Are you seriously arguing that anyone should be able to claim money from your bank account without either prior authorization by the account holder or independent arbitration? Bypassing the courts in cases like this serves no one's interests except bad actors.
I called and complained and the customer service told me that once I had authorized the merchant to charge me, they would accept any future charges even if the card number was closed.
Just curious, have you actually used BofA's service? Maybe the implementation is different now...
If it works, it would be a great way to limit those automatic renewal situations.
Been using it for years. Great service.
For the record, we make cancellation very easy (one-click), and we send emails whenever we renew. And if someone forgot to cancel and emails us a few days or a couple of weeks later, we'll refund happily. But going to your bank and disputing charges is just too easy for people it seems, even for services that they clearly consumed.
I saw your other comment saying that you were able to "fight" this, but can I ask how? we basically gave up submitting evidence on Stripe, because the manual effort is pretty big, and we were basically never able to "convince" the bank (which seems to have the last word). The amounts aren't worth pursuing outside of Stripe, so we just eat those charges from time to time. Overall, they are still a fraction, but still frustrating.
To answer your question, I have also lost Stripe challenges even though I've provided server logs and such. But sometimes I win. It seems almost random. Usually when I win it's a long long time later, and there was no apparent reason. Sometimes it helps to forward an email from the customer stating that they didn't actually mean to flag the transaction, but that they just wanted to cancel.
Sorry that is a frustrating experience. I used to run a B2C site and can relate; I also just ate any dispute. You can automate your response to them via our API (or build internal tooling to create a business process around this) if the number is material to you, but most software companies I know don't see that as the best use of their time.
We're working on various options for improving this part of the charging money experience.
Our dispute rates are still slim, and the actual financial hit is low, but it just feels frustrating and unfair.
There's also this fear that people would "figure it out" and start abusing it on a much bigger scale, but I guess this is not a realistic risk (or I'd like to believe so).
It would be awesome if Stripe helped. e.g. I can imagine doing a one-off or periodic reviews/audits and showing Stripe how we handle cancellations, refunds, etc. From then on, ideally Stripe has a pre-baked appeal ready for us and fights the banks on our behalf. Is it too much to ask?
We’re aware that the experience of even low levels of disputes is a real sand-in-the-shoe irritant for companies operating entirely aboveboard. We have some ideas for products we could make to ease this.
If you’d like to hear more about this, drop me an email. (This handle at stripe.com works.)
If you're going to play that game, you'd better be very sure that you can prove you made all reasonable efforts to cancel the service. Otherwise, blocking a payment method does not absolve you of any obligation to pay for something you agreed to, and you can be pursued for the money (and often interest/fees/legal costs), and if that's all there is to it then you will lose in court if things get that far.
Why do you think that?
For comparison, I work on a service that uses recurring billing, and we have wording in our legal terms specifically so we can go after you for things like the cost of recovery as well if you abuse us like this. Our lawyer didn't include those words just for fun.
But on the relatively rare occasions that someone has been abusive -- the kind of person who repeatedly tries to sign up under different aliases and get a bit more for free in violation of terms, for example -- we can and sometimes do take action, and we have never lost.
It's a little disturbing that so many people's reaction here is apparently a form of wilful ignorance. You can downvote or make comments about how this has never happened to you or talk to your attorney or whatever if that makes you feel good, but your opinion does not change the legal situation: cancelling a payment method is not generally equivalent to cancelling a legally binding contract, and the advice to rely on doing so could lead to people being the wrong side of a real legal action, paying recovery costs that far exceed the original size of the debt, damaging their credit, etc.
It's only reasonable to interpret that as you not calling at all. And in that case it would be abuse to file a chargeback.
It seems like that's not what you actually meant, and you do call first? Great! But you shouldn't be confused that people misunderstood your earlier comment.
I'm always happy to steal from companies that turn my free trials into subscriptions. I'd steal more if I could.
You're coming at this as if the service provider is innocent, and merely providing a service. But we're talking explicitly about companies that give you free trials with the "asterisk, ps, you will pay real money in for this every month on this".
As in you were skimming through the signup and didn't notice the part where you typed in your credit card details and clicked the subscribe button? That seems unlikely.
If you don't want to buy something, the best policy is not to buy it. Then you won't have bought it by accident and have to get your bank involved to unbuy it.
So why are you pretending not to know the difference in this comment?
No, this subthread is definitely about cancelling services in general.
My approach to customer payment is that i don't want your money unless you're happy with the service so if you've gone as far as stopping payment with your card provider, I'll take that as a sign you don't want to be a customer anymore.
I never dispute chargebacks, but instead try to get the customer to withdraw it and behave like an adult, letting me refund and cancel his subscription like we would have had he simply asked.
There's no situation where I'd consider chasing down a customer who didn't want to pay to claw back my fourteen dollars. In my mind, it's not mine to have if he doesn't want me to have it.
I've tried to do this too, but unfortunately you're in the position of asking a former customer a favor, and you can't give them anything in return. They end up in the same position (getting refunded), but have to waste time on the phone with their bank. It's a tough sell, in my experience.
And we're happy to refund, just drop us an email. But going around us to your bank leaves us not only with the refund, but also a chargeback fee, plus it hits our merchant reputation. Granted, it's a tiny fraction of all transactions (because we don't use dark patterns), but just feels really unfair, and not the adult thing in the first place.
I guess both our small business and the customers (and even banks, having to process disputes etc) pay the price for all those big-co contracts that are notoriously hard to cancel.
I get customers doing this for Twiddla every few months despite sending monthly receipt mails explaining how I'm happy to cancel their service and even refund as many months of it as they like if they're not happy for any reason.
But no. Some people would rather call their bank and accuse me of fraud than reply to a mail (or click a prominent link on their account page).
No amount of reaching out to ask them to cancel a chargeback has ever worked. It's baffling. Sure, it's a (way more complicated) way of cancelling your subscription. But it affects my ability to run my business.
So yeah. Don't do this until you at least try clicking the cancel button on the website.
But if the subscriber indicates that they think it's fraud, it's always been the case that they think it's fraudulent to have a subscription or some such thing — never that someone took their credit card and signed up for my service.
The worst incident was where a subscriber accurately described what happened — that he didn't remember it would be a renewing charge — and his credit card company insisted on categorizing it as fraud, even though he explicitly said not to. When a charge is categorized as fraud, Stripe makes you prove all sorts of things that are totally irrelevant where fraud/identity theft have not happened. I think they even asked me to provide a photocopy of the subscriber's driver's license.
So it's a real bummer when people flag transactions instead of taking a second to cancel their subscription.
However, if a company abuses darkpatterns to keep you from canceling (by making you wait half an hour in a _call_ for a service you trialed with a few clicks..), I have no issue with chargebacks.
Out of sheer spite for this dark pattern, I went onto their site every week (via a paid search click) for over two years to cancel the next few shipments until they re-activated their (already existing, but not navigable) online cancelation form.
Unless the user subscribes through something like iTunes or PayPal, where canceling a subscription is user-centric.
The lesson here is: payment card providers need to get with the program and add a new category of charge-cancellation, specifically: user no longer wishes to continue with service, most recent charge reversed and further charges for this service blocked.
I used to use Amazon DevPay for S3stat and Twiddla subscriptions. It's "user-centric" like you describe, where users sign up for to pay for the service through Amazon, and can later tell Amazon to stop paying for it. My thing would get webhooks when those things happened so I could update my end.
But it was only user-centric, so if the user asked me to cancel their subscription, I couldn't do anything except give them a link to Amazon's page to cancel. I could have a Cancel button on my site to stop my end of things, but I had to give them a link and tell them not to forget to go over to this other site and perform the necessary steps to stop sending me money.
As you can imagine, it was not optimal.
I ended up on the phone with Amazon too many times begging them to please stop charging my customer money and sending it to me because neither of us want that to happen, and listening to Amazon explaining patiently that that is not something they can do. No sir, write back to your customer and tell them to re-activate their Amazon subscription then visit this page and click this series of links.
Stripe couldn't arrive fast enough. The day it did, my business was gone.
... and 5 years later I still had hundreds of customers who had signed up using Amazon DevPay, which doesn't have a way of transferring payment details (again, because "user-centric"), so every one of them ended up with the same professionally-embarrassing email exchange asking them to go to a 3rd party website and perform some complicated tasks that we weren't able to perform on their behalf. And sorry.
Why should someone's most recent charge be reversed in that scenario? If they've agreed to pay for a service and potentially been using it during the current billing period, why is it any business of the card company's to provide a facility that forcibly returns money from the merchant to the subscriber in violation of a normal subscription contract?
However, we have absolutely no obligation to do that, either ethically or legally, and I don't see why it should ever be a card company's decision rather than ours. The job of any payment service is to collect payment from a customer and give it to the merchant. It's already bad enough with chargebacks, which as any merchant can tell you are sometimes abused with the merchant losing out through no fault of their own. The idea that there should be a normal, advertised mechanism through which card companies would retrospectively pull back money paid by the customer under a legitimate contract is legally nonsensical.
I agree, and my initial iteration is probably going to far.
It's apparently a strategy that works, and just because it's inconvenient for you doesn't make it their obligation to stop.
Do it for the shitty services but at least do some basic homework first.
For years I had small subscriptions to various digital things; public radio, podcasts, etc. After being burned when trying to change my credit card on a prominent broadcaster and finding there was no obvious way to cancel, I switched to PayPal or nothing for ongoing payments. It's just not worth bothering managing each site's various levels of hostility for dealing with it. After PayPal had some gaffes, I stopped altogether. In the years since I've moved a few to Patreon, but fewer than previously.
It is highly unlikely that every other business has taught them that. Plenty of businesses provide reasonable means to cancel their service for anyone who wants to. Apparently several of us commenting in this very HN discussion run businesses on that basis, and so do lots of other people.
It's apparently a strategy that works, and just because it's inconvenient for you doesn't make it their obligation to stop.
Well, it's criminal fraud, so it is their obligation to stop.
Lots of traditional businesses have been horrible.
Netflix does make it easy. Last time I canceled they didn't even ask why.
Yeah, the thing is, having to cancel services tends to be inconvenient by nature. Usually when someone signs up for something it's because a) they're trying it out to see if it makes sense for them or b) they intend to be a paying customer.
It seems like MasterCard is addressing "a" here which is massively commendable. Companies don't need to auto-charge after a trial period ends, and it seems dishonest to do so. Services like Pandora will just take some functionality and inject advertisements after the trial payment ends or you miss your monthly payment.
Regarding "b", churn is a massive problem for businesses and if my company is doing something to alienate my customers, I would be trying to figure out how to reconcile the issue and retain them instead of trying to force payment on a single month of service and potentially drive them to file complaints against my business.
It sounds like Twiddla might be the exception to the rule and is commendable for that - I've never heard of a company offering to refund months of service fees, but most businesses aren't like that. And to a consumer, that unexpected $5 charge might include $35 of overdraft/NSF fees from their bank that they have to reconcile - to people on a budget, that might be a lot. And some companies will try to recharge the account again and again. I know from experience that DigitalOcean reattempts charges every 2 days for a missed payment without any reference to that in the TOS, even if you have emailed them agreeing to pay the full balance before their account suspension deadline and request that they stop the arbitrary recharge attempts, which can end up costing hundreds for a missed $10 payment.
And these sorts of practices don't generate any extra revenue for the service provider, but they may generate needless churn. It ends up turning into a massive headache for something that was totally avoidable - and it usually ends up hurting the people with the least money the most.
The current government shutdown is a perfect example of why we should be careful about our billing practices.
Thus the frustration of watching people who have done that come back a few months later and charging back all 3 months of service.
Everyone else is talking about people who were forced to put a CC on a free trial and then were automatically charged for a service they either forgot to cancel or couldn't cancel through the channels. (Or decided not to bother with the channels since they're almost always a pain in the ass.)
It's a different situation entirely.
I actually just processed one of these this morning, refunding 5 months worth of payments for a user. Just because they asked.
Still we get the occasional chargeback: we lose the €6/month our service costs and get dinged an additional €30 per chargeback by Braintree. So we lose half a year of customer value for each chargeback. I really wish they would make those chargeback fees more reasonable.
However, that's a very different scenario to someone knowingly signing up for a service on reasonable and clearly advertised terms, failing to comply with those terms, and then blaming the service provider.
(I just had one service I'd trialled & forgotten about ask me to arrange a ... VIDEO CHAT to cancel runs screaming)
But also - if that's what customers are doing, your cancellation button probably isn't as obvious or findable as you'd think (or people lose their passwords). And if you're a small SaaS shop, you probably don't have the time or energy to workshop the whole cancellation experience :)
idk, there's no right answer but "baffling" customer behaviour is always an opportunity to improve what you're offering.
When I tried to do that, they told me "Oh, we don't have any of the forms on hand, try again next week"
Fuuuuuuck that a whole bunch. They also make you do direct debit from your bank to sign up rather then put it on a ccard, to make it more difficult to just stop paying them. I only stopped giving them money when my bank (simple) changed their upstream bank and everyone got a new account number.
I'm thinking of one errant charge that showed on my credit card that I didn't make. I called the provided number, got a recording saying to contact them by e-mail. My bank was happy with that as having tried to resolve it with them first--the bank didn't consider contact by e-mail an acceptable alternative to the mandated 800 number.
Not that it's in the interest of too many providers, though.
As others have pointed out, it's likely nothing personal against you or your company but rather just learned behaviour after dealing with rogue elements - which is/has been most other businesses to date.
Many companies I've dealt with have the "click button to sign up",
but the cancel procedure is "need to call during the 3'rd minute of the eclipse while sitting in a salt circle".
This has been endemic at all levels of recurring commerce. And gyms have been notorious for being damned near impossible to cancel, to the point of massive class action lawsuits.
Simply put, I'm willing to expend the same amount of energy to sign up as I do to quit a service. Past that, I'm reporting billing fraud, and I'll switch CC's if need be. Sorry if you're doing it right, but 99% of businesses that do it do it badly.
What the OP describes though was a merchant making it difficult to contact them. I think in the case where the merchant insists on you calling them and fails to answer their phone, a charge back is warranted.
Let’s stop conflating this with chargebacks after using a service for the billed period ok?
Just how much notification and approval is needed before it's not fraud or otherwise deceitful and questionable legality?
Services shouldn't be telling users a charge is recurring, users should be telling websites that they want to auto-renew. The default should always be a non-recurring charge and selecting anything else should require an email confirmation.
When I had a Xbox I remember that it was SUPER easy to register for Xbox Live Gold (online, done in a few mins, right from the console itself!), but then when you wanted to cancel... there was no menu anywhere. You had to go to the website, find an obscure page with a phone number you had to call, and spend 10 mins on the line with a representative to cancel your subscription.
Needless to say, that was the last time ever Microsoft got my money with the Xbox.
In fact, in my country there is also a requirement that the companies send you a information about this right and forms you can fill out to complete the request with the order confirmation.
Although this comes with some caveats. The consumer protection rules for distance selling are very strict in the EU, but if you're buying something like digital content, it's obviously not reasonable to say someone can pay today but can't then be provided with what they've just paid for for 14 days just in case they decide to cancel. The law does provide for giving up those cancellation rights and getting the content immediately, as long as it's clearly stated at the time of purchase that this is what you're doing.
Because you're not an individual customer to them. They look at customers as if they were a liquid, so they don't bother with individual liquid molecules. If the customers want to flow up, but they want them to flow left, they'll insert some stupid block in the flow path. It doesn't matter the liquid will splash, and some individual molecules will get lost. As long as most of the customers flow in the direction they need, that's all they care about.
I even tried just asking the first person if there are any promos available, to try and skip the song and dance. But they said no. "OK, then I need to cancel." And you're sent over to someone who can get you back down to your prior rate.
I always tell them that $5/mo per radio is the most I can justify paying, and it always works. Then set a reminder to call them again in a few months. Often they'll tell you directly to call back before the promo expires so they can ensure you get back on one. My next reminder is for February 15.
https://www.tivo.com/my-account/cancel
They deserve a public and vocal PR backlash over this.
it's not always that type of scam. services that feature some kind of content upload or distribution ask for cc also to have some sort of hard-verified identity, to prevent service abuse.
I've had plenty of Visa and MasterCard cards and never had credit card
German companies like this prefer to treat recurring billing to a cancelled credit card as a delinquent account. They'll keep the service 'active' nominally, but refer payment to a collections agency ("Inkasso"), who will then send bills, threatening letters from lawyers, and bills for the threatening letters from lawyers. Worst of all, it seems like German law is a-ok with this practice.
Needless to say, I didn't pay for the free trial. It's a shame, because I think their business model is the right way forward. But I will not support such practices.
I thought with Blendle you paid for reads, not for days/weeks/months?
Cannot recall having seen any charges for Blendle since last time I used it.
Looking at you, Pluralsight.
If I like the service and want to continue to use it after the trial period, I simply re-added my billing information.
Cancelling the trial if I remove my billing information during it is unfair because it is just another mechanism to make consumers forget about the service and being billed by a service they don't even use.
Yeah, I may be genuinely interested enough in a new service to create an account and even put my CC information to have access to the trial [1]. However it does not mean that I will like the service and want to continue to use it.
The best way to avoid having a surprise in my CC at the end of the month is to simply subscribe to the trial and afterwards cancel any automatic billing. If I don't do it when I am creating my account, I will forget it later. Yet I will continue to test the service until the end of my trial.
Now if you simply stop my trial is unfair. Why would you want to keep my billing info until the end of trial is beyond any good reason except to maybe try to make me forget about the whole thing and gain some money on people that forget to unsubscribe for services they don't use.
[1]: Multiple times they ask CC information to know if it is a genuine prospect (a.k.a. someone that can really pay for the service later, instead of a bot or something). So it is ok to ask for CC information for trial periods, it is not ok to cancel my trial just because I removed my CC information.
Because any friction in the sign-up process reduces conversion rates, often dramatically in cases like this. Importantly, that applies to customers who would otherwise decide to continue just the same as to those who want to cancel but forgot to do so.
Remember, the only reason a business is offering you a free trial of anything is normally to increase the chances that you'll decide to stay with them and pay them money. If you don't like that arrangement, no-one is forcing you to sign up for the free trial!
Obviously it's scummy behaviour if a business signs you up for something in the small print and then makes it unreasonably difficult to exercise your right to cancel. I don't see anyone disputing that.
But if someone has knowingly signed up for a trial, if it was clearly stated up-front that if they don't cancel before the end of the trial period then they'll start paying to continue using the service, and if a reasonable means to cancel was provided, I just don't see the problem here.
I'd say if it is really for verification I can perfectly understand why a customer removes it after verification if they are still not sure if they are going to stay with the service or not.
Being smart about this can save you a few bucks a year (and/or some hassle).
Personally I just don't test products that require cc for free trials. Saves me even more hassle.
Removing a payment method doesn't equal saying that you never want to use the service again. It can be a protective measure against automatic signup to a paid service.
"The rule change will require merchants to gain cardholder approval at the conclusion of the trial before they start billing. To help cardholders with that decision, merchants will be required to send the cardholder – either by email or text – the transaction amount, payment date, merchant name along with explicit instructions on how to cancel a trial."
However, won't merchants simply stop using free trials and go to a "$1 for 14 days" or similarly impulse-driven model? Sure the conversions compared to free will be tiny but impulse buying is a real thing and dumping someone into a $50/mo subscription after their $1 two week trial would still be complying with this new rule.
20% interest is not inherent a bad thing and shouldn't be outlawed out of hand. If you lend me $20 today and in exchange I pay you back plus buy you a beer on Saturday, that's an astronomical interest rate.
I co-own a brick and mortar business and we charge the maximum late fees allowed by law because people paying lay absolutely destroys our cash flow. It's not because we actually want the late fees - we'd much rather have people pay on time and be able to accurately plan for less money than have an influx of onerous fees. It's not uncommon for a profitable business to fail because cash flow is a problem.
If you work minimum wage and have a spouse or even just kids to support, 20% of $20 isn’t chump change. You have to make every penny count. You’re in an extremely difficult position.
The reason I know this is because of consumer protection laws. Otherwise this number would have been hidden in the very very very fine print of some page somewhere.
Anyway, you can’t cancel online. You have to physically call a number. I ended up putting it off just until the day before they were going to charge me again. Seriously, FU wsj.
https://newsroom.mastercard.com/2019/01/16/free-trials-witho...
HN Guidelines say: "Please submit the original source. If a post reports on something found on another site, submit the latter."
PayPal and Apple's Store show me a list of all services that are authorized to pull money from my account.
CCs don't. You may have to do a nontrivial amount of research (or at least worrying) to ensure that everything is accounted for by the next charge cycle if you were to switch CC numbers without charge forwarding.
If CCs did have a paradigm of services authorized to re-bill you, then we wouldn't have people changing CC numbers to "reset" their re-bills nor to avoid future pulls from their account. But since CCs offer a UX clusterfuck, people will often find the need to clean the slate.
If you want to cancel a service, cancel it with the service provider. Do not rely on anything to do with any payment method that you happen to believe might cancel it. Those mechanisms are for exceptional situations like an abusive merchant who has made it unreasonably difficult to cancel through the proper channels, not for your convenience in avoiding payments you've agreed to make.
An automatic update of my info would have saved me a quite a bit of anxiety.
I found I actually had to track down a third credit card from someone else, add that, delete the old one, add the second one, and then delete the third one. For some startup I might expect that, but it's surprising to have to manage my billing this way for one of the most prominent apps on the planet.
I will plug a service I use (no other relation): privacy.com. It creates credit cards with pre-set spending limits, one-time or recurring. 1-800-hold-forever? No thanks, I'll just send the email and disengage the money hose.
Hopefully this sort of service becomes widespread, and services become less dependent on high-friction in cancellation.
I hear you on the login concern. It was something we launched with and releasing new bank flows is tricky, so we've been doing so slowly.
That said, we do have alternative flows (including micro-deposits). If you're open to giving us another chance, drop me a note (bo@privacy.com), and I'd be happy to set you up.
I’ll probably give you guys another shot. Although I’d still put a mention of how to fund your account on the homepage.
We're releasing it slowly for risk management reasons (so not everyone sees it). Happy to activate it manually on your account though if you'd like.
A routing number + deposits verification system still gives push/pull access, but offers recourse in the case of fraud, and doesn't expose all of your financial history in the process. It's a tried and true system used by many other reputable online payments businesses. It amazes me that they still don't offer routing number based verification as an alternative, quite ironic considering that the company has the audacity to name themselves Privacy.
Final was a much better product in that regard, because it was a credit card, so you could pay from your bank's bill payment page in a push-only manner without giving away any access whatsoever to your bank. Plus the rewards were much better, and you get access to 30 days of float on your purchases by nature of it being a credit card. Too bad the company behind it was acquihired by Goldman Sachs: https://www.fastcompany.com/40523758/goldman-sachs-buys-cred...
I'm still hoping something similar pops up again eventually.
I hear you on the login concern. We've been rolling out alternative flows (including micro-deposits). If you're open to giving us another shot, drop me a note bo@privacy.com, and I'd be happy to set you up.
There will be more communication from the vendor to the buyer. That's all.
Aside from that, I don't think I've ever given my c/c number for any "trial period" offer. I've mostly ever used the usage of that scheme as a red flag to steer away from the business before even considering signing up for anything.
This is not merely because I'm lazy and I don't want to even think about remembering to cancel but because I probably wouldn't want to use such a service at all. The shabbiest businesses are heavily infested with this sort of trickery, but even some good businesses have followed. It doesn't bring any value to the user except one more place where you c/c details can leak away, one more thing to remember and potentially an extra charge that will just upset you.
Trial periods can be implemented without a credit card if you really want to.
- If you don't give full access to what you're offering during the trial period, would-be users won't get a feel of what they might be losing out on when the trial runs out.
- If you do give full access during the trial period, but don't require some kind of hard to get unique enough identifier, a non-negligible users will create new accounts ad nauseam.
(Alternative unique identifiers could be SSNs or ID cards or physical mail addresses. But these are all non-starters. And phone numbers and emails are free for all practical intents.)
Can you speak more to your comment that phone numbers are essentially free? I know with something like Google voice you can get one free number (which still needs to be associated with a non-GV number). How would you get many phone numbers for free?
Also, the original comment specifically mentioned free phone numbers, not cheap or otherwise not-free numbers.
The negligible part is the cost of the freeloaders, there can also be value in freeloaders. They help spread the word and keep up the good word and they might convert rather than going to a competitor. They also represent a good opportunity to show good will.
The non-negligible part is the lost revenue from performing such shady practices as requiring a cc / phone number. If you require that for a trial I will perform extensive research of your competitors. And if desperate enough might consider you after that if nothing else was up to par.
If you allow me to sign up for a trial without an email that is very positive and shows me that you respect your users. That is very appealing.
And very reasonable, because the sole reason for anyone to ask for an email is so they can send spam to it afterwards. Which of course shows me that you do not respect your users.
Look at current Flickr, trying to force users into a one-size Pro membership. They're not listening to light users who won't pay $50 + taxes + currency conversion fees to get 'stats and partner offers'. Instead people are creating multuple accounts and storing 999 photos in each, for free. Flickr should be in that space with $10 Basic accounts
If you've never run a business in this sort of industry, you would be truly amazed at the lengths some people will go to just to save a few bucks.
At an early stage of one of my businesses, the founders were literally sleeping in shifts because a small group of people was creating new accounts 24/7 and trying to scrape our entire offering piece by piece to work around the caps on individual accounts. So apparently our offering was good enough for them to try to clone all of it and presumably set up a copycat site, yet by your argument it was also "underwhelming" because they didn't want to pay anything for it.
Twice I've been stung for that - they're silent for the month, but as soon as you cancel (after navigating their dark patterns) they start the email bombardment.
Requiring payment details for a "free trail" is a huge red flag for me now - simply because it tells me what type of company it may be.
"Mastercard will stop free trials from automatically billing once they're over" is not the same as "merchants will be required to send the cardholder [a message] with explicit instructions on how to cancel a trial."
The former implies you can't do recurring payments where the initial payment was a non-capturing authorization. The latter implies, well, mastercard expects you to get an email from your vendor (e.g. your newspaper or whatever). I suppose said email could be as obtuse as "See website for subscription information".
The third paragraph suggests you'll just receive cancellation instructions before the first payment.
The former would be a massive improvement. The latter is similar to what most (sadly, not all) companies do already.
Not sure which is the case. Anyone got a better source?
The right mechanism should be to request explicit authorization.
Meanwhile, merchants in Europe are looking forward to the new Strong Customer Authentication rules under PSD2 that will come into effect later this year. At least it will be interesting to have hard data on how much damage that causes and whether the damage is worse than the cost of fraud it will supposedly prevent.
The issue is that, well, the whole scheme is designed to protect the merchant (via liability shift) and not the user, and we still have to trust the bank to “verify” us (might not be a big problem in EU, but in Asia it’s still common to have OTP code over SMS or even... a 6 digit passcode)
I see that already from many including our country's national rail company.
Usually a recurring transaction has a different indicator flag set (ISO 8583 field 22, IIRC), and AFAIK subjected to a different liability profile than a standard e-commerce transaction. So I believe this has more impact on the merchant side than a customer.
Disclosure: I (used to) work in credit card payment industry. I have not read the details on this one, though.
> The rule change will require merchants to gain cardholder approval at the conclusion of the trial before they start billing
We get approval for the recurring charges at the start of the trial. Apparently this is now not enough for MC. This sentence makes it sound like the user will have to opt in at the end of the trial to get billed. But the next sentence is:
> To help cardholders with that decision, merchants will be required to send the cardholder – either by email or text – the transaction amount, payment date, merchant name along with explicit instructions on how to cancel a trial.
That sounds like we need to notify the user, but just to give them the opportunity to opt out, not requiring them to opt in. So which is it? Opt in or opt out at the end of the trial?
I'll have to make changes one way or the other, but do I need to just send out the notification and point them to the cancellation page, or do I need to notify them and send them to a go-ahead-and-start-charging-me page before we can start charging them? Can anyone parse this?
If the transaction succeeds they immediately get a thank you email with the recurring terms prominently repeated again. There's also a link to the cancellation button, which is available immediately.
I've accepted this sort of deal as a user and think it's only nefarious if it's not clear or if cancellation is difficult.
Absolutely. A lot of dark patterns are prominent. They prey on an innate human fallibility. In this case, memory.
If you're going to offer a free trial, then you should not need payment information until the end of the trial. You could start sending out reminders to add the payment information towards the end of the trial, instead of an email with a cancellation button, and that would not be a dark pattern. Either practice is a means to the same end, but only the former eliminates the possibility of people paying for what they didn't intend to.
Your trial is about to end. To continue receiving services,
please make payment of {PAYMENT_AMOUNT} by {DATE}. You will
need to authorize recurring payments in the amount of
{PAYMENT_AMOUNT}. You can do that by clicking {PAYMENT_LINK}.
If you would like to cancel the trial click {CANCEL_LINK}.
Please note that if we do not hear back from you by {DATE},
we will have to temporarily discontinue the service/product
until you authorize recurring payments.This is why I am an advocate of disposable CC services like Privacy[1] that have a small window of time for the expiration and stops cards from being sneakily charged without your consent. When I am charged without consent it's like a dark pattern[2]
[1] https://privacy.com *
* Note: Privacy.com is a U.S only service
If merchants can't use that method any longer, I fear this will no longer be an option for people willing to put the work in.
Then again... I am definitely a lazy one.
My second thought was that I hope sites won't stop accepting Master Cards because of this, but I can only assume that they have large enough market share to make this risk negligent.
I just wish I didn't have two of them
https://www.bloomberg.com/amp/news/articles/2018-08-30/googl...
This looks like a significant change in policy. I wonder how merchants are supposed to know about it unless they happen to have read a source like HN today and found their way to the original MC article.
I also wonder what the consequences will be for non-compliance and what will happen if a situation is misunderstood by a payment service like PayPal or Stripe. For example, if we have a regular subscriber who is changing to a new card, we will typically use the payment service's "trial period" facility to delay the first charge on that new card until their regular renewal date so they don't get double-charged for the period in between. That's not a trial period in the normal sense of the term; to the customer, it just means they carry on paying exactly as they have but payments start coming from their new card instead. But there's not necessarily any way for a payment service to know that.
I removed the credit card field from the sign-up form. I was also thinking that this might reduce friction, but I think it actually lowered my "conversion rate". (In quotes because it doesn't really count if you "convert" people who just forgot about it.)
Another way would be to keep the credit input on the sign up form, but require an explicit opt-in before I start the subscription. I don't know that would help. If someone actually needs the service then they're going to add a credit card. FormAPI isn't a "nice-to-have" service, it either solves your problem or it doesn't.
HN: " Mastercard will stop free trials from automatically billing once they're over"
Source: "Free Trials Without The Hassle"
And the source posting provides no indication that Mastercard will actually stop any billing. But instead is requiring merchants to notify customers via email/text how to cancel and send a receipt on each re-bill.
Does this mean that for any service offering a free trial, every subsequent post-trial payment must come with an email or text receipt? What if it's a recurring service but it didn't have a free trial? Is the email/text receipt still required as part of Mastercard's rules?
If it only applies to free trials, it sounds like a lot of merchants will simply stop offering free trials.
I'm curious to see by which mechanism merchants are to "gain cardholder approval at the conclusion of the trial before they start billing".
Somewhat snarky question: Do you think they will do this for their own annual fees?
Of course, if you really want to cause trouble you can do an ACH chargeback, but that could backfire.
Suddenly a year later they take $100 or whatever without any prior notice. An email like "You have an yearly subscription with us. We will charge you $100 again next week." should be a standard.
I'm assuming the simple answer is to simply not accept credit cards for free trials but I don't know if my clients will like this answer.
Even if you're one of the ones who are benefitting and not getting screwed.
Why wouldn’t that work for a trial-to-buy setup that’s programmed to fail once the trial is over?
My MC though has a similar service where I can select the expiration and max amount that can be charged. I've used them to buy services I didn't want to bother canceling in the past. Although again, they sometimes don't seem to work (probably because the numbers are listed as prepaid).
Does anyone remember which company this is? Twitch?
1) it should be an industry-wide, international norm
2) it should be an obligation on the card issuer, enforced. By financial regulation, worldwide.
I'm not a fan of industry self-regulation.
I'm not a fan of product differentiation by security model, in this space. Sure, there are different kinds of risk and mitigation, this feels like something which should be base-level norm.
Which worldwide financial body will make this happen? Mastercard did this without any prodding from a government, as far as I know.
>I'm not a fan of industry self-regulation.
This simply seems like a case of a company offering something that customers want. Is Mastercard working with these companies to the extent that we can really call it "self-regulation"?
Part of the service that government regulation provides is dimensionality reduction.
That is, when you buy X, you might weigh the price up against two to five observable qualities, but there are a hundred more that you can't observe until they bite you later. So capitalism needs some way collapsing those unobservables down. The mechanisms I can think of is:
1. Reputation of the vendor. 2. Other consumers observing what you can't. 3. Government regulation to pin them down to an enforced standard. 4. Other private business partners enforcing government-like rules (for whatever reason).
ggm prefers mechanism 3 to 1,2 and 4. Personally I don't have much faith in any of these four mechanisms, though I am glad when any one of them actually does work.
This seems to be a case are (2) has worked in that MC has decided to make an obscure quality improvement that only some users will notice though many will benefit from, and might become a case of (4) working if they really do cause vendors to improve their behaviour.
Another solution is to create a temporary virtual card.
No u
So all the free trials will become $0.01 instead.
The dodgy ones aren't going to provide either 3DS or a secondary "are you SURE you are ok with recurring payments?". The legit operators are already making it obvious when something is a recurring payment.
The only secure way of getting customers to affirmatively consent to recurring payments, that I can think of, is a separate CVC or similar that's printed on the card. Still, I don't think this is a major problem worth solving. Most customers signing up for recurring payments are aware of what they're doing.
They're doing this to save money processing complains and refunds.
Also, apps like Uber, Bird, ... don't have payments until some time when you use them, how will Mastercard know it is a usage vs a trial/renew payment?