Stripe banned us for payment disputes but we never had a single dispute

It feels like there should just be a better process. Shut down payments to protect yourselves sure, but spare a real life person to email the customer and give them a chance to explain or at least understand why.

You used to offer live chat which is no longer the case, correct ? I understand that stripe has exploded as a business but with all the money being invested in Stripe, I would seriously recommend getting live chat back so at least we know we have someone out there looking for us. Perhaps offer this to customers who are diong a min. MRR (could be controversial).

The attraction behind Stripe is the ease of API but at some point, that will become unimportant if support is not good when we are talking about dollars. Just my 2 cents as an overall Happy Stripe customer for almost 7 years.

EDIT: Never mind. I was wrong.

EDIT: I see that while I was typing you replied to a sibling comment. So we should contact you directly? Can I ask why this slipped through further review, it seems like a bug like this shouldn't require contacting a founder directly by email to resolve.

How can you tell? It seems, naively as an outsider, like the problem is precisely that you can't tell if they should have been rejected, in which case you can't tell how often it happens?

https://tinyletter.com/blauvelt/letters/looking-forward-afte...

More important than that is provide a way for people to get this revolved without having to make the front page of HN.

Not sure what case you refer to, but in our case someone was able to place multiple clearly (in my own hindsight) fraudulent orders on our woocommerce store. And it wasn't Stripe who lost on these chargebacks - it was us. The only way for Stripe to lose money in such scenario if seller (us) would be an active part of the fraudulent transaction. I.e. work together with someone placing fraudulent orders and immediately funnel money away and throw away stripe account. That is clearly not an option for an established business...

And no, it wasn't a niche attracting fraudsters - we sell pyrography tools, not electronics or some other similarly attractive products for fraudsters.

    Stripe can easily lose very large
    amounts of money on individual accounts

Is that because Stripe settles the payment on their end (they pay the merchant) before the payment to Stripe is settled?

Can crypto solve this?

It seems to me that if a company provides such an important service to other companies (i.e. functioning as that company's direct revenue source - payments), then if somewhere it is determined that Stripe no longer intends to provide that service, someone at Stripe should be reaching out proactively, via a telephone or other method, to the leadership at the customer and explaining to them in detail why the decision was made to terminate the relationship and what recourse they have.

I shudder to think of the impact something that an algorithm based decision like would have on my business in this scenario. I would be an absolute disaster, and could have far reaching implications for the viability of someone's business.

Every single decision where Stripe is terminating a relationship should have a clear path to a human being for resolution, and should be reviewed by a human before the decision is even made. Like, setup a conference call with leadership and work through the issue. Most fraudsters wouldn't go through that process anyway, and it provides a proactive approach to working with customers who obviously would be in a complete disaster recovery scenario if this occurred so it would be all hands on deck on the customers side. Nothing is worse than having all hands on deck to address a critical issue and feeling helpless because the other side of the equation is an auto-responder email box.

No business should be writing blog posts for help on something like this.

Do, or do not. There is no "try."

Hire people to manually review final appeals, maybe you've gone too far and are not hiring to keep up with user growth.

  if (transactionInvalid > 5) {
     if (accountPossiblyFraudulent) {
       sendAccountCancellationEmail(accountid))
       stripeBackEnd.closeUserAccount()
     }
  }

Big companies like Stripe need to be reigned in with legislation because they wield the power to destroy businesses and they do it without care.

Where is Stripes ombudsman - a customer advocate - an independent person with CEO level power within Stripe who's primary duty is to customers and is a channel of last resort when your normal support channels have failed? Why don't you have this?

How can you allow Hacker News to be the channel of last resort?

You're running a financial services company and doing it as though it's unimportant to cancel someones ability to invoice.

The lack of protection for your customers is why companies like Stripe need much tougher regulation.

In fact, you as the co-founder of Stripe should NOT be answering here on Hacker News. You should make it a point to NOT personally resolve such issues because if you have to, then you are acknowledging serious failure in your companies systems and serious letdown of your customers. In fact you should be appalled that Stripe so fails it's customers that they must go to social media to solve valid problems. You should simply be able to rely on some lower level person in Stripe finding this and posting a short message saying "please contact our ombudsman", and being assured that your ombudsman will give it due and fair consideration.

So surely this is not the only time Stripe has mistakenly cancelled an account - but this is the one case where the person who's account was cancelled was able to get their issue on the front page of Hacker News. Therefore is can be said that many people have their accounts mistakenly cancelled by Stripe and have no recourse - again where is your ombudsman?

This is serious systemic failure of Stripe. And the worst thing is it is not just Stripe - this is what people have now come to expect from giant companies that are a critical part of business - such as Apple's app store - people now expect that the company might one day send a random email saying, in effect that your business is over. You can't or won't fix it, so the law should.

Stripe founder need to hear this: "sorry" ain't enough.

wrote back to the support asking to reconsider, really hoping for a quick answer!

Every time some big tech company makes promises like these, nothing really ends up changing. The emails always remain vague templates without details from a seemingly anonymous source. Companies end up changing the wording of their email templates, but that's about the only noticeable difference.

I have no doubt that a real human verified the problem and decided to send the email, but I've never seen any big company that swore their dedication to better communication actually change their policies to not make these emails look so... auto-generated. When you're ending a business relationship, even for good reason, you shouldn't come off as a robot.

Such comments on public websites always feel like damage control to me. I'm not claiming your comment is part of some specific damage control operation or anything, but I do wonder if adding that line does much for the credibility of the rest of the post. In my opinion, it adds a layer of corporate pixie dust on top of the rest of your words.

That being said, responding in public, especially in a place like HN, is a pretty brave thing to do, especially with all the other negative threads from others here, so I definitely appreciate the effort you put into this!

Thanks a lo for what you did Edwin.

Vinh.

I can already tell you what happened, Edwin. From your CEO himself:

> We actually have an ongoing project to reduce the occurrence of these mistaken rejections by 90% by the end of this year. I think we’ll succeed at it. (They’re already down 50% since earlier this year.)

Your staff are duking your metrics because you don't understand Goodhart's Law.

I know I've been in lockdown for a while now, but what century is it?

As far as I understand it, a lot of those work like VISA gift cards.

Concerning the cards, we do KYC before the cards are issued and we submit same to Stripe. In extreme cases, we ask for users Govt-issued IDs. Our service might be anonymous to the outside facing world but our users are not anonymous to us and Stripe.

https://en.wikipedia.org/wiki/Ombudsman

> The typical duties of an ombudsman are to investigate complaints and attempt to resolve them, usually through recommendations (binding or not) or mediation. Ombudsmen sometimes also aim to identify systemic issues leading to poor service or breaches of people's rights. At the national level, most ombudsmen have a wide mandate to deal with the entire public sector, and sometimes also elements of the private sector (for example, contracted service providers). In some cases, there is a more restricted mandate, for example with particular sectors of society.

"what these corporations are doing is literally destroying the basis for a developed economy.... [They] have all collectively routed around the rule of law which is necessary for sustained economic growth over time.

In countries with strong rule of law:

1. Property rights over land, equipment, and personal items are clear and protected by law.

2. Contracts between people, businesses, and the government are effectively enforced by the legal system.

3. Political accountability is high and corruption is low.

4. Business regulations are clear and enforced in a transparent manner.

In such environments people make long-term investments and build large organizations. In contrast, if the property rights and contracts are not enforced and the business regulations are not clear, most of the economy consists of small family owned firms with little modern equipment. A high-tech, prosperous economy would not develop.

Effectively, there are no contracts anymore in the digital economy. There is no predictability anymore. There is no accountability. There is no responsibility. There are no requirements for performance anymore. In sum, the US digital economy is rapidly becoming the equivalent of a third-world economy, complete with crony capitalism and digital robber barons."

https://justuseapp.com/free-trial-card claims that one of their main selling points is

> Access the American market

> Our credit card comes with a U.S. billing address, so you can unlock features restricted to the U.S or Western markets especially if you don't live there.

Isn't this just straight up fraud?

Admittedly I'm not familiar with any of the services mentioned, so correction is welcome.

Well at least PayPal has a spotless history of treating their users nicely.

This seems like the key point here. I'm not a software guy or even a payments guy, I'm a network infrastructure engineer.

For anything that we want more than 99% uptime, we put in two of everything, sometimes more. Two separate service providers, ideally coming down different physical paths where practical.

If you have ever been hacked or cannot cancel a renegade subscription, you would quickly grasp the need for Privacy cards.

In some cases, it’s forbidden by law to reveal to someone that they’ve been flagged for money laundering.

https://www.law.cornell.edu/cfr/text/31/1020.320

> No bank, and no director, officer, employee, or agent of any bank, shall disclose a SAR or any information that would reveal the existence of a SAR.

Yet this sort of thing just begs for future draconian government interference. Seems to me a smart company would find a way to not invite that unpleasantness on themselves.

> I have a hunch their main concern is this kind of marketing on your site: „Access the American market Our credit card comes with a U.S. billing address, so you can unlock features restricted to the U.S or Western markets especially if you don't live there."

https://justuseapp.com/free-trial-card

After you have validation of customer buy-in and market acceptance, when you have time and/or funds to spend on your Stripe-alternative feature sprint, setup and integrate a 2nd payment gateway for redundancy.

(as per the commenter above whose biz was banned from Stripe for 7 days by the imperfect non-recourse ban-bot)

Maybe even choose a different gateway that is more cost effective per transaction for a subset of your global customers, and code your system to route customers payments to the preferentially lower-priced gateway for their country.

Then if one gateway bans you, it's not a showstopper and your business is not severely damaged.

Fixed it by using Fastspring. It is a fully integrated solution, with a slightly higher fee, but saves you a lot of dev hours. Their support is amazing.

Edit: it might sound clunky, but asking for wire transfers costs almost 0 dev hours, but can still used to prove your potential clients would really pay.

I assume when you sign up to a free trail, they'll charge your card £0.00 to confirm it's a valid card, then when the trail ends and they try to automatically charge you for a full subscription they'll block the transaction.

https://justuseapp.com/free-trial-card

Ideally, good companies will find a balance with AI and human operators that's also sustainable as a business.

Hiring more customer service humans is not a guarantee that every customer will get what they want.

Seems like a valid reason to ban someone from a platform. Reading further, Stripe was being used to collect money to make hundreds of frivolous lawsuits. (Legal definition thereof)

> 1: The latest payment platform to refuse to accept payments made to Loomer is Stripe.

Looks like Stripe is far the first company to do this. Reading between the lines, this person is specifically trying to get banned to prove a point. At some point, their history of doing so becomes the reason for kicking them off, rather than their political views.

It was absolutely scary the amounts of fraud I dealt with running a dropshipping shop a decade ago.

Every bad fraud order that I dropshipped ate the entire profits from a dozen legit orders, and card fraud was attempted on approximately 25% of orders we received.

After a few years I shut the site down as it was just barely making a profit as the fraud costs escalated and I felt I was wasting my time screening every order with my own (imperfect) hand-rolled fuzzy logic fraud detection algorithms and manual investigation of every single order.

I false-rejected a lot of legit customers in the final year, vowing to stamp out the scammers I drove some customers away... it's hard to be perfect when card fraud is easy to achieve.

Actually what the final straw was for me, that made me delete the server, was not the regular identity fraud stolen-card scumbags, but the pathological liars who you could validate as 100% legitimate, but after they received and signed for the goods, would call their bank and lodge a chargeback to get a full refund, because he banks ALWAYS take the customers side and ALWAYS charged me an extra $35 penalty for every dispute I lost (which was every single one, despite sending pages of strong proof showing the customer was a baldfaced lying thief)

1. Deal with bad actors

2. Misjudge an honest actor as a bad actor

both approach 1.

To make a general statement about Stripe, we'd need a broader statistical analysis rather than a single anecdote.

I think the idea of minimizing harm is a really good one.

I've never done any machine learning type stuff, but, based on my limited understanding, I think there are probably a few issues at play that make things difficult.

I think the feedback loop for an algorithm is likely important. If you're training an algorithm to match fingerprints, you have a few things that work in your favor. First, matching is easier with fewer samples, so you can train the model incrementally with larger and larger data sets. Second, the process of identifying false positives is easy, relatively definitive, and isn't influenced by external factors. If the ML algorithm only has X% confidence you send it to a human who assesses the match and tells the algorithm the answer so it can "learn" for the next situation that's similar.

Contrast that with something like payment processing. First, you need to scale with demand and it's not easy to incrementally train the algorithm. Second, false positives don't have a tight feedback loop. A false positive negatively affects a customer and every case is different. You need to rely on external, subjective data that isn't definitive enough to be useful to an algorithm (IMO).

I think matching fingerprints is a good analogy to illustrate some of the problems, especially when you hear things along the lines of "looked too similar to fraudulent activity." With fingerprints, you could give 10 to an amateur and they could probably match them accurately. Scale that up to 10,000 and you have so many that look similar, but not identical and you need a professional to do the matching.

I think ML is similar. It's better on a small scale than it is on a large scale and just doesn't scale up as well as the sales pitch says (unless it's assessing problems with definitive solutions). The issue here is that tech companies are treating ML like it scales in a linear fashion. Just throw more compute at it and 10x the scale, right? Wrong (IMO).

There was another comment here that said something along the lines of getting to 98% accuracy and deciding not to serve the other 2%. I think that's what's happening everywhere, but rather than explicitly telling customers they're not welcome, companies are simply letting their ML algorithms run to find the equilibrium where they can manage the "not positive" rate.

And that goes back to your idea of minimizing harm. They don't want to. They don't care if they promise you service even though you're borderline in terms of triggering false positives. You're part of the data set for their machine learning algorithm and that means you're viewed as acceptable collateral damage. They'll ruin your life to train their ML algorithm(s).

This might be the craziest thing I've ever seen in a support email.

You can build a system that efficiently serves the 98% case of "simple" customers. Then you can ignore the 2% unprofitable/complicated customers, forcing them to go to other vendors.

If you're big enough, you starve your competitors of the low-cost/simple customers. So their cost structure goes way up, which in turn prices the services out of reach of all other customers except the stupidly profitable, which is to say: gambling and porn.

(This has parallels to the USPS v. FedEx/UPS problem in the US, with the exception that the USPS is required to serve all customers, so no one is completely without service)

Users have to manually fund their cards. This takes care of all the issues you mentioned above.

> it looks like JustUseApp was collecting money for the virtual cards by pushing through unauthorised payments to the users original card.

> Additionally in the EU, the introduction of Strong Customer Authentication basically makes these types of transaction completely illegal

Was this the case?

Finally, all bigger software shops face this issue so we are not unique.

1. https://kinsta.com/blog/credit-card-fraud-stripe/