Stripe Chargeback Protection | Hacker News Reader

Stripe Chargeback Protection

stripe.com

341 pointsshedside213 comments

But this isn't the product I want.

I don't want to ever fight chargebacks. Because my policy is to never take money from people who don't want to give it to me. I want to automatically refund every chargeback attempt without it affecting my ability to charge credit cards.

One of my businesses targets consumers, who have this amazing ability to "forget to cancel" or to have "cancelled 3 months ago, but for some reason we're still billing them" or to just plain decide that the last six months of charges were fraudulent and that their bank should get them reversed.

All of that is fine with me, and in fact every invoice I send out says as much: We'll happily refund every penny you ever paid us if you simply ask. But lots of people aren't comfortable asking for their money back. They are, however, plenty comfortable asking their bank to ask for their money back.

I just want a way to streamline that process that doesn't involve me having to handle fighting disputes that I'd prefer to lose. And of course to not have those lost "disputes" count against me.

Any ideas on how to do that, Stripe?

Why isn't this a feature of _every_ merchant account?

But lots of people aren't comfortable asking for their money back. They are, however, plenty comfortable asking their bank to ask for their money back.

I think you are being generous in your interpretation. I don't get many chargebacks but looking at the ones I've had there has been a lot of deceit and fraudulent behaviour.

Do you mean it's your customers who are being deceitful by charging back a service after they've used it (as mine do). Or do you mean that you have customers using stolen credit cards to pay for your service and that the chargebacks are happening when the card owner discovers as much?

I haven't seen any evidence of that second case happening with my users (apart from one incident where card thieves discovered my "update your credit card" workflow and used it to sanitize numbers for a few days before I fixed the loophole). But the first one happens all the time.

It'd be adorable in a way, as I'm sure the people doing it think they're totally getting away with something. If, that is, it didn't jeopardize my ability to continue charging credit cards in the future.

The first except they continue to use the software after they have done the chargeback.

Also expense fraud, the buyer purchases on their credit card, makes a claim with their employer then does a chargeback to get a refund.

I also get a lot of people buying a single license and using it on multiple computers but that's really a different issue.

Would you feel that way if you were selling physical goods or even services where you had to pay workers - like a lawn business?

It sounds like you are selling a near zero marginal cost software business.

I do have server expenses that map directly to processing work done for individual customers, so there is a quantifiable amount of real money lost at times. But at the end of the day, I still don't want somebody's fourteen dollars enough to fight them for it (even if it means I also lose another $5 in real expense and a few more in chargeback fees).

But you're absolutely right. If it were physical goods or services, I'd fight those chargebacks for sure. (Though it'd be a lot harder for one of my deadbeat customers to plausibly claim that he'd "forgot that I mowed his lawn").

Once a chargeback is filed you are losing the fee if you either accept it or don't fight it. My cancellation process is simple, certainly simpler than contacting your bank and identifying yourself and going through the chargeback process. That doesn't stop people from going to their bank for the last 3 months of subscription and calling them fraudulent because they never told us to cancel them. I fight every single chargeback because their always lies by the customer in my case and they involve real money already spent by my company. We win some and lose some.

Not sure about OP’s costs, but I sell physical goods and have a similar attitude: I don’t want money from anyone who’s not delighted to give it to me. Most people are good most of the time and it works out fine.

I have had a couple of obvious scammers take advantage, but that’s on them to square with their conscience. Life’s too short to spend it fussing with folks like that.

I agree. I use to have rental property and when you evict someone you theoretically can go after them for back rent and fees. It could total well over $2000. But it wasn’t worth the hassle and you factor that possibility into the rent you charge.

Or as my southern grandfather use to say:

Don’t chase after old money or old girlfriends

People who sell physical goods bake the cost of these losses into their pricing. In fact, any large business will have financial analysts whose sole job is to calculate exactly how much they'll need to inflate their prices to make up for losses due to fraud, theft, accidents, and the like. It's kind of like being your own insurer, except the customer pays your premiums.

But I doubt that I could order $5000 worth of furniture, have it delivered, dispute the charges and then the vendor just shrugs.

But, I’ve never disputed charges outside of obviously being double charged. Most of the time, I’ll speak with vendor.

Unfortunately, this is exactly what happens with identity theft.

Imagine if someone stole your credit card number, ordered $5000 worth of furniture with it, had it delivered, and then you discovered the unauthorized purchases on your account and disputed the charge. The vendor has no choice but to just eat it.

It's unfortunate, but it happens, and the only way to mitigate it is to raise prices to offset this kind of losses.

That sucks. I didn’t think about it from the merchants side.

We can send you a webhook on every dispute being created (https://stripe.com/docs/webhooks) and you could use the API to either refund the underlying charge or accept the dispute (and refund the underlying charge).

We can also give you access to receiving early fraud warnings from issuers (like Visa TC40s). These are notifications from the issuers that the customer is likely going to dispute a charge. If you're happy proactively refunding customers you could do so without incurring the dispute fee (though TC40s and the MasterCard equivalent can still count towards monitoring programs). Let me know if you're interested (eeke@stripe.com).

This gets you most of what you want. The subtleties:

1) The credit card ecosystem wants to discourage chargebacks as a routine mechanism for canceling, and so there will still be a fee assessed by the networks and hence by us.

2) The credit card networks have thresholds for how many chargebacks a customer can be doing while making responsible use of their rails, and if one routinely exceeds that, they will give a very serious warning to change business practices and, if one’s numbers do not improve, they will terminate one’s access to the rails. We have substantial experience with B2B SaaS businesses and it is _extraordinarily_ unlikely that a B2B SaaS business comes close to those thresholds, even after accounting for unfortunate user behavior.

How does that work? When I'm notified of a dispute, the first thing I do is go in and refund the charge. I still have to watch the whole dispute resolution process play out and have it be ruled against me.

How would I go about stopping it before it starts, as you seem to imply is possible?

Edit to add: Does it even make a difference if I go in and refund the disputed payments? It sounds like I get dinged either way and the customer gets their money back either way. Should I save myself the effort?

Doesn't sound like they're implying that it's possible.

Sounds like they're allowing you to automate the dispute process but it'll still be a negative mark on your account.

Side note, are you getting anywhere near the number of disputes for this to matter to you? Seems like you have good refund policies and you'd probably be below the threshold for account termination.

Card issuers are often able to detect that a transaction is fraudulent before it is disputed, and when this happens, they will send us a notification. These notifications are commonly called TC40s (Visa) or SAFE reports (MasterCard). On average ~60% of early fraud warnings end up being disputed, and most disputes have an early fraud warning (though there’s a wide range depending on your business). If you refund these charges before they become disputes, you can avoid the dispute entirely. It doesn't solve all dispute problems but it can be pretty effective. I’m happy to take a look at your account to calculate what percent of disputes have an early fraud warning.

That’s pretty cool. Is this something Stripe customers have to pay an additional fee to access, or is it included?

Another question: what’s the percentage of false negatives?

It says on the page, the service costs 0.4% per transaction.

That's for the service in the original link. Not sure that's the same for the potential service under discussion here.

It’s included! And, in fact, we just launched the API publicly.

https://stripe.com/docs/disputes#early-fraud-warnings https://stripe.com/docs/api/radar/early_fraud_warnings

As for the percentage of false negatives, it really depends on your business. We definitely recommend looking at your own early fraud warning and disputes history to determine what makes the most sense for you.

  Card issuers are often able to detect
  that a transaction is fraudulent before
  it is disputed, and when this happens,
  they will send us a notification.

Is there a mechanism like that but in the reverse direction? i.e. if a seller detects someone testing stolen cards, and wants to alert the card issuer all those cards are stolen?

I think Strip has a report fraudulent transaction feature. I've had someone do several $1 test charges on a donation page for a charity I managed. I was able to report the approved cards as fraudulent transactions.

This was many years ago. At the time, I think it was a beta feature so I'm not sure if it's been rolled out to everyone yet.

Shouldn't the issuer be able to figure this out on their own when they see the attempted charges coming in? It seems like the resources of the issuer would be better spent improving their own detection rather than dealing with third-party reports.

Retailers might enjoy better information (account history, items in basket and suchlike), might have already borne the cost of manually checking the order, or might have better incentives (as it's them who loses money if an order was placed with a stolen card)

After all, if the issuer had been able to figure it out, the payments would have failed preauthorisation.

Too much abuse potential, for instance, a software error could flag 'good' cards as 'bad' and cause a lot of headaches for other merchants.

Yes, but the only way to get that data is to read an email that Stripe sends. There is no programmatic access to the data.

But wait, what about Stripe Radar?

If card issuers are "often able to detect that a transaction is fraudulent before it is disputed" (presumably because of transaction history) then why can't Radar block the transaction from ever taking place? Maybe there's more to it than transaction history? Can you clarify?

Here's a stylized example which may help:

Monday: credit card does a transaction at a particular business.

Thursday: user calls bank to report card stolen as of previous Sunday. This kicks off a TC40 on all transactions on or after Sunday.

Friday: bank staff and/or user walk through the transactions which were post-theft, figure out which ones were still authorized (e.g. the recurring Netflix bill), and file disputes on all the other ones.

Since there is no way to send the TC40 back in time to Monday, it can't influence the fraud scoring run at the time of the transaction. But there is, in this stylized example, a window between the TC40 and the dispute for the business to proactively investigate and possibly refund.

Isn't this what Ethoca and Verifi do?

> But there is, in this stylized example, a window between the TC40 and the dispute for the business to proactively investigate and possibly refund.

There is also a perfect opportunity for the IPSP to flag the transaction and reverse the transaction before it becomes a problem for the merchant.

You are proposing he should also proactively refund the other ~40% of valid purchases to avoid the ~60% that end up in disputes? Did I get that right? If yes, that doesn't sound like a viable idea.

If it’s a SaaS business, that may very well be a viable approach. The cost of dealing with a dispute on the 60% of claims could be significantly more than the profit on the 40% that won’t be disputed. Additionally, the customers only get back the money for the disputed transactions, not perpetual future access to the software (as they would if it were a physical good, or a shrink-wrapped disc).

"the other ~40%" -- are NOT necessarily valid purchases. Most likely they are fraudulent purchases that were not charged back.

60%… I've had some of my customers' cards get reported as stolen, and a recurring charge pop up (on a customer who had subscribed months ago) and get flagged. I do not act on it, a dispute gets filed, and the customer wins the dispute despite me providing evidence that this was clearly an intended charge (and clearing that up with the customer afterwards!).

Winning a dispute on Stripe has always felt impossible to me. I stopped trying after a while, and just let the disputes default to a loss after they time out.

We're about 50/50 on the relatively few chargebacks we've had. In 100% of the cases, it was a genuine charge for a real customer, the customer openly acknowledged that when contacted, and this evidence was supplied as part of the dispute.

Our customers have generally been responsive when asked about a chargeback. It seems like in many of the cases there really had been a problem with their card being stolen or the like, but often all subsequent transactions had been disputed by the card issuer, even long-standing recurring charges. It wasn't clear in many of these cases that the customer had requested this, or even knew that it was happening.

Even when customers assured us that they had personally contacted their card issuer to tell them a charge was legitimate, that was no guarantee that the chargeback would be cancelled. Unless we have customers who are spending considerable time writing apologetic emails to us and offering to pay us some other way and yet for some reason lying about that contact, the card issuers aren't keeping up their side of the bargain here.

In 0% of cases was it worth the time we spent putting together comprehensive evidence to dispute a chargeback, even when we won. Like scrollaway, we just don't bother now.

If you have a system where a charge can just be arbitrarily reversed and it's not worth fighting it as the merchant even if you have overwhelming evidence of its legitimacy, that tells you how legitimate the whole system is, doesn't it?

It's telling for the industry as a whole that the card companies failure to do their work properly still can result in extra charges to the merchant.

After all card companies have a tremendous amount of data at their disposal and are apparently able to detect a large percentage of fraud before a dispute is raised and yet do not pre-emptively block the charges or reverse the transaction.

I've been on the receiving end of these kind of dispute resolution processes and in spite of doing everything by the book we still ate quite a few chargeback fees on charges that to us looked just as legit as every other charge that passed through. (Not with Stripe though.)

They optimize this for max profit. Of course. So they found that this is the sweet spot, that generates the maximal volume while keeping fraud to minimum (also keeping users as happy as they can - that is not bothering them with preventative measures, and then of course making it easy to do chargebacks).

60%...wow.

Cool - thanks for answer Q

> We can also give you access to receiving early fraud warnings from issuers (like Visa TC40s).

Can we get webhooks for these? We currently have to manually refund charges when we get the ‘suspicious transaction’ email from stripe, which is a pain.

You can indeed get a webhook for these: https://stripe.com/docs/api/events/types#event_types-radar.e...

(disclaimer: I work on Radar at Stripe)

> We can send you a webhook on every dispute being created (https://stripe.com/docs/webhooks) and you could use the API to either refund the underlying charge or accept the dispute (and refund the underlying charge).

Unfortunately, I don't think that's possible.

On Stripe, attempting to refund an actually disputed charge results in an error / invalid request.

https://stripe.com/docs/error-codes#charge-disputed

It does work for inquiries but I am not sure how often those happen vs. "proper" declines/chargebacks. I'd assume the majority is of the latter type.

Refunding a charge back is / can be a bad idea - you can refund, still lose the charge back, and pay for the chargeback. For a $100USD transaction you risk losing 230USD as opposed to 130USD if you refund. It's even written on the dispute page on stripe to avoid refunding charge backs

Is it possible to have the extra fee (.4%) only on some transactions or does it have to be applied to the entire account? For example in what we do we have very large transactions where we know the customer very well and we don't need this. But other transactions are typically small but more importantly they are of a different type where the risk of fraud is much higher and the protection is warranted. Just wondering other than getting setup for two different accounts (which may not even be possible) how this situation would be handled. I do understand the idea of wanting the .4% not applied selectively however it would be good if there was a way to specify the transaction class in some way to account for this situation.

adverse selection ;)

I think this request is like going to a $60/month gym and asking to only pay 2$ when for days you go the gym because you only use it 10 times a month. The .4% on good transactions is subsidizing the shitty transactions.

Stripe can do refunds through their API, so there's nothing stopping you from building this feature into your own business, on your own site, with your own branding and wording, etc.

I would look at Steam's refund flow for inspiration.

That's different from what OP's point is.

Dealing with refund requests is easy. The problem is customers who request chargebacks from their banks instead of requesting refunds from you.

Payment providers usually contest such chargebacks automatically. This ends up costing you a fee. And if you lose the dispute, or issue a refund as a matter of course, these chargebacks contribute to lowering your account's reputation. If this gets out of hands it can put your ability to receive payments in jeopardy.

What would be much more ideal is that, when the bank signals that one of its customers is contesting a charge, the payment provider would simply refund the charge without questions. And, assuming refunds (and chargebacks) are the exception rather than the rule, without the process lowering your score.

Ideal for a company that has near infinite markup on the goods (eg. SaaS business with very good unit economics). As somebody that processes a lot of payments for physical goods (electronic devices) the preference is not as clear cut. You ship out the goods in the COGS value of couple K of USD just to get the chargeback.

We've ended up adding additional heuristics to mark the fishy payments and manual checking before shipping out.

Something like Stripe Chargeback protection actually makes sense and I'll ask my team to look into the ratio of chargebacks to see if it makes sense to migrate from Braintree just because of this.

No quibble there. Stripe Chargeback makes good sense indeed in your scenario.

Unless you have an easily visible telephone support number, I’m issuing a chargeback. It simply takes less of my time and idgaf about your business model.

Isn't that harder than replying to your last invoice mail with the words "Please refund this and cancel my subscription"?

Why involve the telephone?

I think many people have been conditioned to assume that replying to automated messages goes straight to /dev/null. Have you considered putting a link to a page that provides a quick cancellation workflow?

Here's one of those invoice mails in its entirety. Sent from (and reply-to) info@twiddla.com. See if you can figure out how to go about cancelling your subscription or getting a refund:

Your Twiddla Bill for April 4, 2019 to May 4, 2019

Hey, we wanted to let you know that on May 4, 2019 we charged your credit card $14.00 for your monthly Twiddla Pro subscription.

You can find additional information regarding your bill, individual charges, and your account history by logging into your your account at https://www.twiddla.com/ and navigating to your "My Account" page. You can also make changes to your subscription or cancel it altogether from that page.

If you have any questions regarding this charge, or would like to yell at us until we refund it, please contact us at info@twiddla.com.

Thanks for the business!

Jason Kester

info@twiddla.com

https://www.twiddla.com/

I have no desire to yell at you, simply to cancel the account and request a refund. While sending an email is okay, it would be better if there was a link directly to a page to do so, just like unsubscribing from an email list. Regardless, I would recommend changing the wording from "yell" because that sounds hostile, and most people don't want the conflict.

One nice thing about running your own business is that you can develop your own "voice" throughout the copy on your site and in your communication with users. And that that voice need not be soulless nor corporate nor cleared by Legal.

Plenty of people have taken me up on the offer for a refund, and none of them felt the need to "yell", so I think they got the correct vibe. All our site copy and mails have this same casual, friendly tone. People seem to like it.

I understand wanting to have your own style. I am not opposed to the casual tone. You were complaining that some customers don't take you up on the offer, and instead contact their banks to request a charge back. I was suggesting that changing that one word (but not necessarily the casual tone) might make a difference in encouraging some of those people. But it is your business, you can try the suggestion or not, I apologize if my comment came across as pushy or anything like that.

The people who did end up writing in are not your problem though, are they? It's the ones who don't. I wouldn't base my experience on the ones who cooperated.

Casual tone is one thing (a good thing), but I posit that an actually angry customer will not respond well to this.

"Oh damn I get this email again... and they are telling me I can cancel, but I think I already cancelled... wth. Hmm, maybe they'll give me a refund."

Now at that point whether the customer is right or wrong they'll read the yell part and think that you are mocking their potential interest in demanding a refund.

Maybe I am totally alone here (with the other guy I guess), but while I wouldn't go dispute a charge myself that wording of yours would not encourage me to write in and get my hopes up you are happy to accomodate me.

You’re assuming there is an invoice; many times there is not which is why the chargeback is auto-approved.

For better or worse, the chargeback is the only weapon end-users have anymore.

That's utter nonsense. Most reasonable companies will offer you a refund if you simply ask, especially if you haven't used the service or incurred any costs for the company because of your failure to cancel. When you sign up for a monthly service it is not the company's responsibility to make sure you want to continue each month. Some still do, but it is not required.

Right, but if cancellation becomes a dark pattern, use a dark pattern in response.

You know that bullshit "no-reply@lazy-company-with-garbage-customer-service.com" email that many companies use as the sender for communications? Too many don't even bother to name the no-reply account as that but essentially send from a no-reply address.

So, does your reply reach them? Who knows. Now you have to set yourself a reminder to follow up and make sure the request got through.

Alternatively, you hunt down their support email but you still need to follow up.

Then there are the rare times a company fights you on it. Then you have a whole back and forth before they finally capitulate.

I personally go through the hassle but I can understand why OP wouldn't want to.

Not the gp, but in my experience emails like that are usually Do Not Reply.

some people (myself included) strongly prefer interacting with live humans, over emailing and hoping that stuff gets fixed. E.g. in McDonalds, rather than ordering in a kiosk, I go to a cashier, it's actually easier and faster this way.

Regardless of the ethics of this approach (I don't even want to touch that part), continuously charging back has a number of ways that can ultimately hurt you:

1. If you run this scheme enough and your credit card company flags your account for excessive chargebacks, you could very well have that card shut down and take a credit hit along with it. 2. More and more companies implement against (effectively) data brokers who are going to tie your chargeback history into a risk score. This very product from Stripe is absolutely going to score risky behavior in part based on past chargeback history.

What's easier & takes less time now is not a guarantee on something being a net good decision, so other people should think twice before going with a scheme like this.

Few consumers are going to be aware of such potential drawbacks, and those who are will generally risk it anyway. I think you underestimate people’s eagerness to trigger a system that makes them feel powerful and righteous.

Oh I am fully aware of people’s eagerness, which is why I’m not even going to start with the parent poster. I’m here for anyone else who comes by who innocently thinks that might be good advice ;-)

Regulations like the GDPR together with consumer outrage will prevent companies using risk scores for too many things that materially affect the customer.

What are you people subscribing to that's getting you to this point? Other than a gym, I've never spent more than maybe 2 minutes unsubscribing from anything in my life.

> to have "cancelled 3 months ago, but for some reason we're still billing them" or to just plain decide that the last six months of charges were fraudulent

I've had both of these things happen as a consumer. Coschedule kept billing me for six months after I cancelled (and my accounts administrator didn't know we'd cancelled), and I had Experian in the UK continue billing me for six months after they'd disabled my account but hadn't told me. In the former case, they refunded it straight away once I pointed it out, and in the latter I had to escalate a little, and start talking about a small claims court, but they refunded it in the end.

I guess my point is, both of these are valid consumer complaints, and waving them away as being stupid consumers probably isn't that useful for anyone. Further down, in another comment, you imply that this is deceit / fraud.

I do have the occasional customer claim to have "cancelled 3 months ago" via email. We keep good records of such things, so we know him to be mistaken but I always make a point of apologizing and issuing an immediate refund.

I word my "Why did you open a chargeback" mails the same way, and offer to handle things via a refund (and to please close the dispute because it affects our business). But the people who use their credit card company instead of email or the prominent Cancel button on the website don't tend to ever respond to those mails.

It's frustrating, because so many people have had to deal with health clubs and Comcast that they just assume every business will fight against them if they want to cancel.

> We keep good records of such things, so we know him to be mistaken

I assume Coschedule also believe they keep good records of such things, and indeed when they checked those records, they found I had cancelled when I said I did, but they'd continued to bill me anyway. You are truly exceptional to run a business where mistakes never happen, and when they do, they are always the customer's fault.

  But the people who use their credit
  card company instead of email or
  the prominent Cancel button on the
  website don't tend to ever respond
  to those mails.

What's the user experience for someone whose credit card details have been stolen and used to sign up for your service?

Presumably such a person wouldn't have the credentials, the e-mail, or the cancel button?

Perhaps the ethical thing to do in those situations is to fight the dispute? Acquiescing encourages bad actors.

Your current course of action is probably still best for your business and sanity, though. Hmm...

I assume you send an invoice/receipt email every month by default, to reduce the chance that a user forgot to cancel and to make it easier for those that wish to. (If not, I think Stripe Billing offers this, though I'm not sure...)

(disclaimer, I work at Stripe, though not on Radar or Billing, thoughts my own, etc)

Keep in mind that making it easy to terminate subscriptions eliminates most of those chargebacks.

It’s one of the reasons that I use Apple whenever possible to handle recurring subscriptions. It takes about 10m to file a dispute with American Express. If figuring out how to cancel a subscription takes longer, I’m cutting my losses at 10m and heading to Amex.com.

Perhaps industry standards around subscription management would help? I think there is a lot of real fraud/unethical behavior exists in this space and legitimate retention management can easily cross the line in the consumers mind as scammy.

There is no legitimate retention management. If I want to cancel I've made clear what I want to do. Making it take longer then a few minutes is a waste of all our time.

There is a fine line in my POV.

Word trickery and playing games with buttons is over the line.

I think it is ok to say “Hey, you’re paying $20/mo for the super plan, and don’t use feature X, but can do the middle plan for $12”. I think it’s ok to make sure that people understand that data is deleted if they take the action. But it’s easy to drift into dark patterns.

One of the reasons I left my first job out of college is that management wanted the cancel subscription button on our website replaced with a phone number.

The other side of this is that there are some customers who can't manage to cancel a subscription even when they literally just have to log in, click/tap to go to whatever page handles their personal details, and then push a prominent button to cancel and maybe a second confirmation one to prevent misclicks. The entire process can take less than 10s, yet you'll still get people who email you claiming they can't find it and have been looking forever and now they'd like a refund for their last six months of payments please. Remarkably, although they have trying to cancel for months and have looked everywhere, some of these people have no entry in your logs showing them visiting any of the personal settings pages on your system, nor is there any record of any previous attempt to contact you via any of the five different methods you advertise prominently for customer support...

Now, we're generally fairly relaxed about subscriptions. We very much take the view that it's not worth quibbling over the odd month's payment and we'd rather offer good customer service and build a good reputation. For example, maybe someone seems to have made an honest mistake but we believe they really did intend to cancel and they haven't used our services since, and in that sort of situation we tend to just refund them anyway if they ask.

However, cancelling a payment authority or charging a payment back retrospectively is not a substitute for cancelling a legal agreement, and in some cases it also hurts us. If someone deliberately messes us around like that, we are much less sympathetic, and we certainly consider whether to pursue them through legal means to recover what they owed us and any other damages and costs.

I think this is fair, but do you ever manage to actually recover the funds?

I'll answer your question, but I should say up-front that my businesses mostly deal with relatively low-value transactions, so although action is always considered in these cases, usually we decide it's not worth pursuing. On the occasions that it's been deemed worthwhile and we have started the recovery process, we have never reached the stage of formal court proceedings. Generally once someone realises that their actions were not acceptable and we really are willing to go further if necessary, that tends to resolve things quickly. So I suppose the honest answer is yes, we did get our money and sometimes a bit more than the original amount owed due to interest/penalties/etc, but I don't know how effective our intended next steps would really have been other than where we've had positive legal advice.

You might feel differently if you wasted a whole week on a service, only to get scammed and left with less than nothing and a bad reputation with your bank.

I’ll agree that what you want maybe best for some forms of business, but what are you looking for here? A fundamental change to the credit card system?

Stripe isn’t going to make it not count against you, because the card companies are certainly holding it against Stripe.

So unless you convince Visa and MasterCard to change their way of doing business, I’m not sure you’ll get what you want.

There's chargeback services who pay banks to tell them first so you get a chance to respond before it hits your merchant account.

This will let you refund and pay less fees at the merchant account level. I've used https://chargeback.com/

Longshot, but you don't happen to be th3j35t3r, do you? The name and description on ExpatSoftware seems so fitting :)

> We'll happily refund every penny you ever paid us if you simply ask.

I'm all for giving customers the benefit of the doubt (and I'm definitely generous in giving refunds too), but doesn't this policy go a bit too far? Even if your costs are near zero, I find it somewhat unethical to say "yes, I have proof that you used my service and received the value I promised to provide... and yet the contract of the sale (implied or explicit) - past or present - is effectively nullified at your request at any time".

While it often doesn't make sense to chase after money from customers who make these kinds of requests, it also feels wrong (to me) to encourage that kind of consumer behavior. The retroactive part seems especially ripe for abuse from customers who decide to switch to a competitor, making their switching cost effectively negative (they're incentivized to leave you).

Yes - on the whole, people are usually honest and respectable. But in my experience, a surprising number of those same people value saving a few bucks over a clean conscience.

Let's assume you're running a scam (thought experiment). If it was possible to refund anybody who complained and not have the complaint affect your ability to charge credit cards, then wouldn't every scammer do this?

I think it's fair to assume that few people will notice a fraudulent charge, and much less bother to dispute it.

If you charge money you don't feel like you need to charge -- then simply don't charge it :)

For a subscription simply ask inactive users to sign-in and confirm that they wish to maintain their subscription.

I don't think that's something available on Stripe, but there are a few tools available in the payments processing ecosystem that allows you to do just that: "notifications of fraud" and "requests for information".

Basically, the first is a notification triggered during the chargeback initialization process on the bank, but before the chargeback is actually processed. So when you receive the notification, you can still issue refunds, cancelling out the incoming chargeback.

The second is similar, but is at an even earlier step of the chargeback process where the user simply asks its bank some information about a line on their statement they don't recognize.

> I want to automatically refund every chargeback attempt without it affecting my ability to charge credit cards.

That is just not how chargebacks work, sorry. I do think there is merrit to urge issuers and card brands to change the chargeback behaviour or rules, i.e. to always give the merchant the opportunity to refund first. Essentially to make the retrievals or inquiries flow mandatory for all disputes. There you are given the opportunity to refund and respond before escalation.

Stripe and others cannot do much here except for lobbying.

But, this is the product I want, because I sell high end used luxury watches, and chargebacks are the biggest PITA and one of the hindrances to profitable growth in that sector.

Losing out on a large chunk of a $15k transaction because the buyer thinks the condition of the watch is "not as described" (where in reality, they know this is an easy way to scrape a huge discount on their purchase because the criteria is so subjective and petty) makes life very difficult. Sure, 95% of my customers are great, but that 5% really deals material damage when you are talking about high cost physical goods.

This product offering is interesting, and is worth investigating and weighing its cost against my average annual losses from chargebacks. In your case, you are offering SaaS so your marginal cost must be negligible. Different strokes for different folks I guess.

Keep in mind that the protection seems to only covers certain types of disputes: https://support.stripe.com/questions/payments-that-qualify-f...

For instance "product not received" , "product unacceptable", or "subscription canceled" would not be covered.

Would you be willing to offer a discount, say 5%, to customers who made an irrevocable payment? No chargebacks guaranteed.

> We'll happily refund every penny you ever paid us if you simply ask

IANACFO, but I think your balance sheet for this business is going to be pretty wack. To guarantee this, you need to keep a pool for refunds (edit: and with your specific guarantee, isn't it all revenue ever?). If you don't, that can be a real issue with the business. This happened at Groupon:

https://www.cfo.com/management-accounting/2012/04/groupon-re...

That article explicitly mentions "big ticket deals" at "higher price points" as the problem there. Many SaaS businesses charge each customer pretty small amounts and get very few chargebacks. The time it takes to fight a chargeback, even if illegitimate, isn't worth the amount of the charge itself, to say nothing of the opportunity cost of getting more customers who want to pay.

You know that charge back costs you money right?

But what if you've physical products where you already inoccured sufficient cost. What if someone buys from you again and again and chargeback each time?

I'm in a similar boat.

If Stripe cant do this for you then I know a way you can. Give me a shout on nathan.watkins@axcessms.com

How did you arrive at 0.4%? That seems like a lot to pay for insurance.

If they take 2.9% normally, 0.4% is about 14% extra in fees for every transaction you make, but disputes on a legitimate product are probably 1 in 5,000 (and Stripe will charge you a $15 flat fee if you lose the dispute which you will if it was related due to credit card fraud).

If you sell 5,000 products at $50 that's $250,000 in revenue. Stripe would normally take 2.9% which is $7,250 but now with "fraud production" they would take 3.3% for $8,250. So you've just spent an extra $1,000 out of pocket to save yourself $15 in a dispute fee that Stripe charges you. That's really steep.

If you had 66 fraud charges within 5,000x $50 transactions (to break even on fees), I would really look into why you're getting so many disputes. That's astronomically high.

0.4% is an insane rake. The whole chargeback system is broken.

Most disputes have nothing to do with the quality of your product, they're because it's a card number has been stolen and being used illegally and the merchant has no way of knowing this. You're not just out the $15, if you've delivered given the customer merchandise, you'll have to absorb that loss. Most times you won't know a charge has been disputed for around 30 days, so your merchandise is very likely to be gone. The $15 is nothing for many businesses...

The value is there is you have greater than 1 in 250 transactions charged-backed and lose. This is high, but certainly within the range -- consider that Signifyd has business for their chargeback protection at a 1% rate. Of course Stripe has more data for better risk modeling....so perhaps Stripe should not be allowed to charge for additional charge-back protection services since it implies they now have a dis-incentive to prevent charge-backs for customers who aren't paying extra.

I guess I'm out of touch on what it is like for physical products.

I only sell digital products but the dispute rate is over an order of magnitude less than 1 in 250.

I sell a physical product on a Shopify store. Charge-backs cost me $8000 out of >$3,000,000 revenue (14 orders out of 11362). At least one of them (totaling $2000) I should have known was fraudulent because I even asked for photo ID confirmation and received a scan of a print-out which I didn't check well enough.

I simply started to require PayPal for international customers instead of Stripe checkout and that reduced fraud to zero.

(edit: PayPal fees are like 4.4% for international, but it's cheaper than using something like Signifyd on-demand which takes 4% on top)

Thanks for sharing real numbers.

So you would have paid $12,000 to Stripe for charge back insurance, which is double what you really paid (well, it's not double since you really paid 8k, but from the sounds of it that 2k loss could have likely been prevented with a more careful background check which makes it a 6k loss).

Question: would you pay that extra $4,000 to $6,000 to never have to deal with charge backs again?

No. I evaluated Signifyd and the truth is that it wasn't worth it economically or from a "never have to deal with charge backs" perspective, because I still have to deal with the operational errors that cause most of my charge-backs.

When you sell a physical product, usually you get "friendly" charge-backs because the customer didn't receive the product. This means something is wrong with your logistics like a package went missing or didn't get sent out. Often you also missed the messages from the customer wondering where the order went---saying they will contact their credit card company if they don't hear back from you. So you can't just not deal with that.

You must be selling digital products where the marginal cost of what you send to your customer (who disputed the transaction and isn't sending the product back) is $0.

Yep, that is true.

In the physical product's case, you are out the $15 + $50 (or whatever your product cost you to make and ship).

This is huge! Our business sales registrations to educational events for a specific industry. We use Stripe to process.

We have a strict non-refundable policy on ticket deposits because, otherwise, we can't determine how many seats are left for each event and we lose the revenue on that empty seat.

We often get unscrupulous customers who claim they don't recognize the charge because they decided not to attend in the 11th hour!

We also have the rare individual who completes the entire 3-day training and then claims they never got the service!

Because it's in-person training, it's hard to prove they received the service. For example, there are no postal records we might show as proof that we shipped a physical item and it was received.

Now, we have them sign a document affirming they got the training prior to receiving their certificates.

But, still, Chargebacks are stressful, because they create revenue and profit uncertainty for each event.

The dollar value of our fraud rate is about .3-.7% per event. But we always fear the outlier event, where that number spikes. For example, we set aside 2% of revenue from our most recent event (which is thousands of dollars now tied up) to prepare for any unanticipated spike in chargebacks.

And... the stress and frustration of fraudulent chargebacks is a non-zero intangible cost.

I will gladly pay .4% to get revenue certainty!

At this time we don't use checkout though. So will need to look into what we need to do to change to that.

I believe we're using Stripe Elements. (I'm the business owner and a programmer, but I didn't code our original stripe integration.)

Will be looking at this today!!!

Thank you so much for your work on this feature! This is a real game changer for businesses like mine!

Have you looked into 3D secure? Stripe already offers it[1], no fees, and it mitigates liability quite a bit. Lots of business owners here probably can't use it because they do recurring billing, but it sounds like it'd be perfect for you.

"Should a 3D Secure payment be disputed as fraudulent by the cardholder, the liability shifts from you to the card issuer. These types of disputes are handled internally, do not appear in the Dashboard, and do not result in funds being withdrawn from your Stripe account."

[1] https://stripe.com/docs/payments/3d-secure

Interesting. Thank you for the suggestion.

Just took a look at 3D Sure. My only concern would be the drop in conversions.

I wonder what the typical drop in conversions is with this enabled.

I have a sense it could be high single digits to low double-digits (e.g. 7-11%).

In which case, that would cost quite a bit more.

I did see there is a way to trigger this as needed.

Hmmm...If we could figure out a way to identify high risk individuals in advance, that might mitigate the drop in conversion.

Hmmm... Maybe a fun machine learning side project.

What categories of disputes are those?

My guess is that as with 3D Secure only actually "fraudulent" (e.g. payment not authorize) disputes are covered, but "service not rendered" (?) ones are not.

Things like this are great for the average to small merchant, BUT if you're processing more than, say, 50,000 USD a month, relying heavily on the Stripe ecosystem can take its toll and can cost you big time.

- Use Stripe as the only gateway for all your international traffic, and you will see alarming drops in acceptance rates, meaning the chance of successfully charging a Mexican customer in Mexico with a US Stripe account is much lower than if you have a local acquirer. By a lot!

- Rely heavily and blindly on Stripe Radar for post-charge suspected fraud alerts charges, and you will be refunding many valid orders.

- If you go all in with Stripe Checkout, you are getting a lot of good stuff at a price. If stripe dynamically uses 3DS to sift potential fraud users, you are going to hurt your conversion rates.

Been a big fan of Stripe for a long time, but when order volume goes up, and you grow internationally you have to consider other alternatives and/or backup plans, such as smart routing, local merchants, alert networks (ethoca, verifi), pre-checking for pseudo 3DS charges (no auth need, but fully protected, etc)

Not taking into account these 3 things, can drop your conversions by big double digit percentages.

EDIT: spelling

Thanks for your comment. We want our products to substantially decrease the barriers to international commerce, and they’re used by both businesses which are just getting started up to multinational companies with extremely sophisticated understanding of their payments needs.

Auth rates are a deep topic, and one we’re experimenting on constantly.

The topic of whether a particular business will get better auth rates going through a local gateway is a complicated one (that is probably true of many businesses and not true of many businesses); we’re working on making this sort of thing unnecessary for most businesses to think about. Philosophically, centralizing this sort of work at Stripe makes a lot of sense to us; we can deploy more engineers against auth rates than any Stripe customer could because we have a much larger surface area for improvement than any customer does.

Many of our users want something which works out of the box, and they’re the target audience for Checkout. If you want to rigorously test the behavior against your sophisticated understanding of conversions in your own business, that’s awesome; you can see exactly which transactions we flagged for being on the fence using the API.

It’s always a balancing act to make things which work out-of-the-box for someone’s first business on it’s first day and still have the power and configurability expected by extremely sophisticated operators. Getting this balance right is extremely important to us.

Thank you for your many detailed replies here! This idea that parent brought up is one I've heard before: Stripe declines payments that a local gateway service would have accepted, for reasons unrelated to fraud protection. That's always made me scratch my head because my (admittedly primitive) understanding is that you're eventually hitting some API at the bank which accepts or declines the charge. Why would it matter whether it's Stripe hitting it or some other gateway? I assume Stripe has more resources to attack such problems than your average Mexican gateway provider, so there must be some intractable problem in there somewhere?

We switched from stripe to local payment gateways in some countries because some banks automatically convert any charge by stripe to USD making it more expensive for the end client and refusing in some cases the charge, when in local gateways everything goes through in the local currency.

Additionaly stripe charges their 2.5% to 3% + 2% conversion fee making it impossible some business models that are low margin.

I’m the PM on Chargeback Protection. Startups told us they don’t want to deal with the hassle and unpredictability of chargebacks; that’s why we built this. Happy to answer any questions you have.

Great product! Will this be rolling out in Hong Kong at some point in the future?

(PM on Chargeback Protection here.) We’d like to extend Chargeback Protection to all Stripe countries eventually. Stay tuned!

Completely unrelated, but please add an alternative fee structure more appropriate for microtransactions. Stripe has a vast amount of useful features from which my business could benefit, but its cost is prohibitive as all our transactions are for low amounts (1$ or less), which make your 30cent fee a 30% of the total.

We are forced to use credit cards directly and Paypal, as both offer a much lower fixed fee (sometimes 0) in exchange for higher %.

https://support.stripe.com/questions/microtransaction-suppor...

0.4% is an extremely steep price for a company like mine doing over $2.5m in annual turnover (saas) which has a very low fraud rate. I actually think currently we pay less than that by doing nothing (meaning letting Paypal handle it, and losing every case). However I'd gladly pay a few thousands per year for it, or be able to pay it on selected transactions (only US for instance).

you should look into chargehound[chargehound.com], i think they would work for you.

Their cost estimator estimates 30 minutes preparing a chargeback dispute. I do them when they come in and it never takes even 5 minutes.

Hey there, founder of Chargehound here, it's a slider so you can adjust it to 5 mins if you want.

Many companies do take up to 30 minutes especially if they are compiling a comprehensive portfolio (if the dispute is for thousands of dollars) and are outsourcing the representment.

Use a separate (insured) merchant account for the dodgy transactions?

> However I'd gladly pay a few thousands per year for it

0.4% on $2.5m is $10k a year. I realize "ten" is a bit more than "a few", but is Stripe's price point materially that far off from where you want it to be?

Said another way, I imagine that there are at least a few problems smaller than chargeback protection at your company that you throw $10k or more at just to make that problem go away... right? If so, this makes their price somewhere between reasonable to good.

I am really curious about your thinking on their price as it relates to other expenses in your company. Could you expand on that?

What he's saying is that currently doing nothing costs him less than what paying 0.4% to 'insure' transactions would, so why bother with insurance?

Ultimately established companies know how much chargebacks cost them and thus whether this product is worth it (= costs less).

Another thing to take into account is that if you're not using Stripe Checkout now, you will have to migrate to it, and since Dynamic 3DS will be used to filter and "secure" potential fraud, you will probably see a decrease in conversion rate.

welp I'm ashamed, my mental math was off by one zero, and I thought I was going to pay 100k/year. At 10k I'll buy without thinking about it.

Then this offering isn't cost effective for you and you can ignore it. I'm not sure I understand why this thread is full of people complaining it doesn't solve a problem this solution isn't targeting, or, like you, saying this costs more than simply accepting your low chargeback rate. When I rent a car, I decline the offer for me being able to return the car without gas because for me, it's trivial and cheaper for me to refill the car. I don't complain that the price should be lower, or that they should instead be offering sunroofs on more cars.

And I'm the opposite. I return the car empty every time, because the cost of "finding a gas station" when you're in a hurry to catch a flight isn't worth the extra $X they charge for the service to fill it. Choices are great!

It’s called product feedback. You are also complaining about the poster’s complaining, which is essentially the same thing.

As an end user, how can I tell the modal dialog is actually my bank?

It looks trivial for the vendor to man in the middle attack.

I’d take my business elsewhere if presented with a UI from some random e-commerce site asking for extra personal information.

3D secure payments in Europe have been a standard for years - being presented with additional verification steps for online purchases.

Attacker cannot know who you bank with. Plus, most of the time the confirmation screens are something like confirming 2nd/Xth characters of your password/date of birth.

> confirming 2nd/Xth characters

That is somehow significantly less reassuring than not having 3D Secure payments in the first place.

I bank with Monzo and they send a push notification to my phone with an "Approve" button. No way to fake that.

Any ETA on when chargeback protection will be available for Stripe.js?

No ETA just yet, but we are exploring ways to bring Chargeback Protection to other integration options!

Before this, if a customer opened a dispute and you won, you (the business owner) didn't have to pay any dispute fees without having to pay for anything extra. It was just a part of the standard Stripe offering.

You even wrote this on your site's documentation[0]. Here's what it says as of right now:

> There is a dispute resolution process through which you can respond and submit evidence to make your case that the payment was valid. If the dispute is found in your favor, the disputed amount and fee is returned back to you.

If we don't opt into this new fraud protection service, are all dispute fees still waived if the business wins the case?

[0]: https://stripe.com/docs/disputes

I work at Stripe. That’s right! Nothing changes in the way we handle disputes for businesses that are not on Chargeback Protection. Your dispute fees are still waived if you win the dispute.

I'm curious if there is a way we could avoid the cost all together if we don't need the money deposited in our bank accounts right away?

I work for a non-profit & we had some very large donations come in online through Stripe. Someone did a typo donated $10,000. I'm sure we could set some max limit & say no donations larger than $X but it was common to have $1,000 donations. Even with a $1,000 donations the fee gets expensive.

In our case, we don't need those funds immediately. We would much rather not have access to them for a month & not have to worry about a request for the funds to be refunded.

Will Stripe still take efforts to prevent fraudulent transactions for customers who don't pay an extra 0.4% for it?

I work at Stripe. Yes, absolutely. We’re continuing to invest in Stripe Radar and our machine learning fraud prevention (the team is doubling by the end of the year!). Radar is included at no additional cost in our standard payments processing pricing (2.9% + 30 cents in the US, with similar pricing elsewhere).

Don't know if anyone from Stripe is listening here but: it'd be amazing to be able to deploy chargeback protection selectively, as a Radar rule. So that for example we could say: charges from the US are protected (and subject to the extra fee) while charges from the UK are not.

Not an expert in this area, would'nt that flow against the general laws of insurance?

It'd still be enabled prior to the original charge being made. The details in the link suggest that some charges would be exempted anyway (eg ones that don't use the new Checkout, ones over a certain threshold). So it's a question of whether or not a given individual charge is insured, not a question of whether your Stripe account as a whole is insured.

Insurance products are typically designed to make money for the provider. I'm sure they are doing a lot to lower risk.

That’s exactly what we’d like. 95% of our transactions come from trusted customers which have ~0% chance of a chargeback. We’d like to apply this check and insurance on only the transactions that we are not sure about.

Requiring it to be all or nothing makes the feature useless (not cost effective) for merchants with a low fraud rates.

Is it a 0% chance, or a 0.4% chance?

It may not be cost effective for you, but your proposal doesn't seem cost effective for Stripe, either.

Is it not the point? If stripe allowed you to do that - insure only dangerous transactions - then it could not be 0.4% but rather a few %.

The entire point behind insurance is to have enough volume so that the small % when they need to pay up won't affect the business.

I would imagine stripe will always block charges it thinks are likely to be disputed. They aren’t offering carte-blanche to accept transactions that are likely to be fraudulent.

Perhaps it wouldn't work for stripe (to allow the merchant pick and choose which transactions use this service). But if it doesn’t it means that the service won’t be used by clients with low fraud rates.

> If stripe allowed you to do that - insure only dangerous transactions - then it could not be 0.4% but rather a few %.

This would depend on how well stripe can detect fraud.

And if the price is higher to insure individual transactions, that still would be a nice/valuable service to have.

Adverse selection inflates premiums, simply because people who need insurance are the ones who buy it.

The point of insurance is to transfer* risk to the insurer. The insurer does that by identifying a group that is homogenous enough that their premiums are just slightly over the payouts.

So an insurer can improve competitiveness by selling multiple products that cover different risk groups. I imagine that for Stripe, the risk variance falls in a fairy narrow band: bounded at the low end by not being worth insuring, and bounded at the high end by merchants losing their account.

* As opposed to say retaining risk, e.g. you don't buy collision on a beater.

That's how insurance works: it relies on the majority of activity being fine and only a minority of it actually needing insurance. If you could select only the transactions with high risk to be insured, they'd have to charge a lot more than 0.4%.

Thanks for the feedback! Our first priority at the moment is seeing how this performs and then rolling out additional integration options, but we might explore giving users additional control over the mechanics as time goes on.

Has anyone done the math on this? You’re paying an extra 0.4% fees per txn which is a lot. So your dispute loss rate would have to be > 0.4% for this to make sense. That seems pretty high. That probably means your overall dispute rate is above 0.6%. In my experience you can get your dispute rate well below 0.1% (effectively a non-issue) by making sure your support channels are working and not clogged, and you have a generous refund policy (and of course being honest about pricing and billing, especially for subscriptions).

To me this seems like knowing about a small leak in your basement, but instead of fixing it, you buy a basement water damage insurance policy.

So, .4% fee for $10,000 in sales amounts to $40. And losing one chargeback dispute costs you $15, plus time and effort to fill it in and submit it. Not to sound cynical, but odds are you will probably lose it anyways because the customer didn't feel like paying anymore.

Am I missing something? The chargeback protection fee doesn't sound terrible

Yes I do lose most disputes regardless of what the situation is, and I did forget about the $15 fee. I guess it really depends on the type of business, will probably make sense for some, but as a consumer I do see a lot of small businesses out there that should be looking first at how to get their chargeback rate low enough that they don’t need something like this in the first place.

I believe it's happened before where people have setup bot accounts to buy game licenses from indie developers, just to resell the keys on G2A/Kinguin. However they do it with stolen credit cards, so the indie developers get hit with a 15$ charge PER order. If there's 1,000 keys, that's 15,000$ in chargeback fees.

So it might be reverse, it might be a no brainer to accept this extra protection because like you said, 40$ fee @10,000 isn't that big of a deal, given only 3 chargeback fees are necessary to break even. Unless you can REALLY manage your chargebacks. If your product costs 20$, so 500 people buy it, you only need a .6% chargeback rate before you should've taken the extra protection.

And as a poster above says, he'd sign up for this for "revenue certainty".

Would you rather make $10,000-$20,000, or make $17,000? For some, they'd take the sure $17K over the possibility of making less and losing money after cost of goods sold are taken into account.

Are you assuming that the cost of the disputed transaction - the goods that were sent to the customer and supposedly not coming back - is $0?

For $10,000 of sales of one's music $40 does not sound terrible. For $10,000 of sales of high-end watches $40 to have the reimbursement is a helluva great deal.

Chargebacks happen. Wven if you do all you mentioned, sometimes people see a charge they don't recognize or forgot about and do a chargeback.

Beyond everything that 0.4% also buys you ptedictability, which is often more precious than margins.

Chargeback insurance/protection is not new in the industry. And despite how nice it sounds to not have to worry about chargebacks, I think it's a bad deal for almost everybody.

The basic problem is that your incentives are not aligned with Stripe's: you make money when a good sale goes through, but that's when Stripe might lose money (if the transaction ends up being fraudulent). So they have an incentive to block any marginal orders, which means you lose revenue and suffer reputational harm of blocking good users.

Then there's the price: companies with a good fraud protection system / process typically keep chargebacks <0.1%. (For large companies, this means using something like Sift or Accertify along with a fraud review team, for smaller businesses it might just mean manually reviewing every order). So you're paying a lot for the convenience.

[Disclaimer: Used to work on fraud protection at Sift]

I agree with you. Incentive alignment is a major issue--I asked the PM in this comment thread and hope for a response, because I think this issue needs to be discussed.

That's why anti-fraud-as-a-service companies only charge the commission when they approve the transaction, while the declines are free. If everything is declined, they are not making any money.

[Disclaimer: Used to work at anti-fraud-as-a-service company, acquired by a payment behemoth long since]

Used to run an online game, where lots of fraud was going on. People would buy ingame coins or whatever, move them elsewhere and then chargeback. Full protection at just 0.4% would have been a dream for me if I still operated that game.

Stripe are not idiots, if they’re losing a significant amount of money on this offering to a specific merchant, they’re going to close your account.

Is that stated anywhere by Stripe or is it theoretical?

> We may terminate this Agreement or close your Stripe Account at any time for any reason (including, without limitation, for any activity that may create harm or loss to the goodwill of a Payment Method) by providing you Notice.

Interesting - I've been following bolt.com, which seems to guarantee zero chargebacks as well. Given Stripe's scale I now wonder why the value add for Bolt over Stripe is supposed to be now.

Genuine question: how can this make financial sense for Stripe?

If Stripe charges 0.4% for it... then presumably any business with chargebacks of <0.4% value won't bother to use it (except for rare cases of needing to reduce risk on extreme low volume of high value items), so mostly only businesses with chargebacks of >0.4% value will use it...

...so almost by definition the mean cost will be greater than what Stripe is charging, and Stripe will lose money.

Since Stripe is full of smart people... what am I missing here? How is this a viable product?

Many business <.4% will use it because it takes a job off of somebody's plate and these will tend to be larger customers. Small places that deal with a chargeback or two per week are not going to bother.

I just have to point out this little page of caveats: https://support.stripe.com/questions/payments-that-qualify-f...

Biggest thing for our company: "The payment must be submitted to Stripe by your customer via Stripe Checkout. This means that recurring charges are not eligible for Chargeback Protection"

Meaning this does not protect our B2C subscription company from any recurring charges which is a huge percentage of our charges if not all of them.

Also: "The dispute must be one of the following types of reason codes (as identified by the relevant Card Network) listed in Appendix 1 of the Terms of Service: Visa: 10.4 Other Fraud - Card Absent Environment Mastercard: 4837 No Cardholder Authorization Mastercard: 4840 Fraudulent Processing of Transactions Discover, Diners Club, JCB: UA01 Fraud Card Not Present Transaction American Express: FR2 Fraud Full Recourse Program American Express: FR4 Fraud Full Recourse Agreement American Express: F29 Fraudulent Transaction - Card Not Present American Express: 4534 Multiple Records of Charge (ROCs); Card Member denies participation in Charge American Express: 4540 Card Not Present; Card Member denies participation in Charge"

Many of our chargebacks fall outside of these chargeback reasons so it would likely not be worth it for us to use this feature, as I'm sure is the case for many other subscription based companies.

> The payment must be submitted to Stripe by your customer via Stripe Checkout. This means that recurring charges are not eligible for Chargeback Protection

What's going on here? I thought Checkout specifically supported setting up subscriptions:

https://stripe.com/docs/payments/checkout/migration#client-s...

If recurring charges are not covered that's fine I guess but I don't get what it has to do with Checkout.

You’re right that wasn’t very clear. If the subscription is started using Stripe Checkout and charged at sign up, the initial payment is protected by Chargeback Protection. Trials that are charged at a later time and future recurring payments are not protected. We want to broaden the scope of use cases for Chargeback Protection over time.

It'd be great to see Stripe adopted by donation platforms for livestreaming like Streamlabs and StreamElements, chargebacks remain an awful abuse vector there.

Didn't Paypal add a TOS clause (or something along those lines) that prevented donations from being valid for chargeback?

How does that even work? The chargeback is initiated and the fee levied by the card issuer (Visa, MasterCard, etc).

PayPal ran into some bad PR a while ago with people making "fake" donations to the tune of thousands of dollars and ended up refusing the chargebacks. But as far as structural change, things are still pretty bad.

Streamlabs's tutorial on chargebacks was updated as recently as a month ago: https://support.streamlabs.com/hc/en-us/articles/11500601766....

The chargeback originates with your bank, not with Paypal.

Congratulations!! Love the philosophy around the product and the dynamic treatment of higher risk transactions with Checkout routing to 3DS.

It must feel great to be able to support such a "simple" product, as I know there must be a ton of complexity under the hood enabling the simple form factor.

0.4% seems high when a sustained rate of 1% will get you kicked off VISA and Mastercard anyway.

This appears to require the new Checkout product in order to enable it. What happens if we have a percentage of sales coming from a native iOS or Android app? Are we not allowed to enable protection? Or would just the web transactions be covered?

(PM for Chargeback Protection.) Yep, Chargeback Protection only works with the new Checkout so we’ll only protect any transactions that are processed through the new Checkout. You can keep your existing integration for iOS and Android, but those charges will not be protected.

Does this mean Stripe will change its allowed merchants? We sell digital telecom products and Stripe does not accept our business. This would be a product we could use, but can't if they are still rigid about their accepted business.

Is stripe actually the one blocking you? Card brands regulate which MCCs are allowed to be signed on by acquirers. It could be Visa, Amex or Mastercard.

Gosh, I’d love to use this for accepting cards for our $29k device, but the limit in the US is $25k in protection for the entire year.

We offer a hardware product with SAAS after purchase, and we have dozens of customers insist on paying for that hardware with a credit card (albeit we won’t accept one now because of the inherent risks of accepting a card).

If the limit was much higher, I’d be sold, and our volume with Stripe could go up by $1m/year.

Would this cover a marketplace scenario? For instance, we use Connect and transfer a purchase balance to our Connect account users after a purchase is made. If we encounter a chargeback, we also have to come up with the full cost of the item sold to cover the loss because the seller has already been paid. I'm wondering if this new service would cover that scenario.

In France to my knowledge we don’t have a right to chargebacks, the only case when we can be reimbursed is when a fraudulent use of our card is made and we then declare a credit card number theft and the card is blocked. How is the situation in other European countries?

I run an ecommerce website in France, and I use Stripe (french account), and I get a couple of chargebacks per year. Usually, it's the customer who gets his CC stolen, blocks it and declares all the transactions in the timeframe as fraudulent.

FWIW, I have had 10 chargebacks and lost the dispute for each of them even with the delivery address matching the CC name and the proof of delivery... But I will pass on this protection, the price is way too high for us.

Why limit this to Checkout? Checkout seems limited and resides on Stripe's servers. Who wants to be redirected from a secure website to another domain??? Outside of web savvy people, nobody has ever heard of Stripe.com.

hmm if your chargeback rate is 1% or less, this costs more then a 15 dollar chargeback anyways. at 100 AOV at 1% cback that's 40 dollars to cover what would have been 15 dollar chargeback. also if your description photos and tracking are on point there should be no chargeback you can't win, unless your processes are off.

Big agreement on the just refund vs chargeback and effect possible merchant rate increase or suspension. Would rather cut into profits a bit then have headaches of upset merchant.

In short: Pay extra and we'll include chargeback insurance.

I mean if they have to do more than the usual on their end and the service ends up working out, why not?

I don't get it? You want free insurance?

Any plans to offer this without requiring using Checkout specifically? We use Stripe Elements because it enables a more native seamless payment collection UX.

(PM on Chargeback Protection here.) We are rolling out with our new Checkout first because it allows us to tweak the checkout flow and e.g. send a payment which we’re on the fence about to 3D Secure (3DS) but let obviously good payments go through without 3DS. We are also exploring ways to expand Chargeback Protection to other integration options!

Thank you so much for your work on this! Really hoping you expand this to elements. (See my comment at the root level.)

This is a game-changer. We do all or nothing semi-annual educational events and fraudulent chargebacks are a HUGE source of anxiety.

.4% seems to be a very fair percent as well to charge to make this problem just go away for businesses like ours.

We happily refund customers that go through normal refund channels, but fraudulent chargebacks are a significant source of stress and revenue uncertainty.

Just last night I was shaking my head as I stumbled across an email from a customer confirming that her friend referred her to our event and that she was coming. But then a couple months later she changed her mind. We told her it's way too late for us to give her a refund on her deposit (which was clearly stated to be non-refundable in the first place). So she told her credit card company that she doesn't recognize the charge.

Even though we added her emails to our dispute evidence, and submitted evidence that she was aware of the non-refundable policy for ticket deposits, we still have no idea whether we'll actually win the dispute.

Incidents like this are a major source of frustration, and your solution is going to help us operate with less uncertainty.

Hi Eeke. A few years back, we lost a merchant account with stripe due to an unfortunate combination: no chargeback insurance enabled, high average transaction value (~600EU) and low monthly volume (we were starting up).

Got one charge back for 800EU that blew us out of the water. Would there be a mechanism to re-apply, with CB protection enabled ?

We struggled to have this discussion with a Real Person at Stripe to discuss this .. would you have any leads ?

Hrm, I'm sorry for that struggle. I'd like to look into this—could you email me directly at edwin@stripe.com and I can review what happened (and see if we can help you get set up again)?

The chargeback is one of the few tools consumers still have with real power. Sure fraud is still a problem, but it's a really uncomfortable proposition to start making chargebacks an abstracted cost sink for the corporations.

Of course the fact that this is an upsell line item means only big businesses will pay for it, the smallest businesses owned by the people just starting out will be the only ones who actually suffer punitively from chargebacks.

Some things shouldn't be streamlined. Some pain is good. This is a really unfortunate choice by Stripe.

But this product isn't taking away consumer protection via chargebacks, nor hurting small businesses in any way.

I think the Parent is upset that businesses will no longer be inconvenienced and pained by a chargeback.

What will Stripe do to prevent this being abused?

You mean Stripe?

Yeah, what a brain fade. Thanks!

By telling you they would likely defeat the purpose of those actions.

(I work at Stripe on Radar.) We see Chargeback Protection mostly as a way to prevent our users from burning too much founder attention doing chargeback management. Managing abusive use of the credit card rails, both by fraudulent businesses and by people attempting to defraud legitimate businesses, is something that we have substantial experience with. We have had years to tune our machine learning models; this both helps every user of Stripe (through blocking transactions likely to be fraud-y) and gives us the confidence we need to roll out a new product like Chargeback Protection widely.

We will, of course, monitor it during the rollout and adjust as we go.

> prevent our users from burning too much founder attention doing chargeback management

Yikes. Yes. Thank you. I wish i had this 2 months ago.

Will this work with stripe elements not just stripe checkout? I'd like to upsell my connect accounts this feature.

Is this only if you're using checkout?

Reply on news.ycombinator.com