The dark side of Shopify
twitter.com
twitter.com
Stripe also did the same exact thing for very similar reasons and at one point we had over $300,000 USD frozen with them, which was basically our entire monthly payroll expense. We had to explain to our bank why our accounts were suddenly drained. This one was worse than Shopify's since we actually never received any communications notifying that this was going to happen. At least we got an email from Shopify that we just hadn't noticed.
They're all broken. And Know Your Customer needs to eat shit and die.
You're not going to stop people from misentering addresses, and many countries have terrible validation or streets that don't exist yet take forever to show. Or the system that suddenly decides to start doing validation doesn't actually accept valid addresses.
Companies think automation can handle it, but it's an absolute nightmare.
As a customer, I wanted to buy something and the website wouldn't accept my address (since it wouldn't accept any "/" characters). Guess what? There are plenty of addresses in the US with "/", such as 50 1/2 Foobar Street. Address validation does not always work, so companies shouldn't act that way.
"4 Blah Terrace", "4 Foo View", and "4 Bar Lawn" are all within 100m of each other, have the first half of the postcode the same, etc.
Google Maps/etc can't handle this at all.
The small-town post office will sometimes _delete_ the physical address in the mail system so the actualy physical address is completely in-valid (or worse gets autocorrected to an address a mile away).
Turns out FedEx and UPS base their address validation off USPS and also don’t ship to PO Boxes.
In "federal-style" countries like USA, it is possible for some jurisdictions to have adequate validation while other jurisdictions (e.g. the rural county where I live) do not.
I live in a place where the official address changed: as in we got a letter (in 2016 I think) from the town hall saying "your address is now ... and you have to ask everybody to mail you at that new address". Well... Most utility bills' systems have been programmed in a way that make it impossible to keep the same "installation ID" (as in the ID on our electrical install) while changing the address. Somehow "the street got a new name" is a case that had never been planned.
The implications are wild (for example the bank refusing to open an account because the official, legal, address doesn't match the address on the utility bill and then the contry's IRS thinking there are shenanigans going on).
That's in a civilized, western EU, country.
It's Brazil (the movie).
This feels a lot like Germany (from experience).
You can use something like https://btcpayserver.org/ and be your own payment processor with very little work.
Kind of frustrating that HN hates bitcoin so much, that even under link/article about small merchant getting harassed by shopify/stripe, they would rather downvote any mention of real solution..
It doesn’t matter if 1% of cryptocurrency useful and not a scam: because 99% of it is, if you use crypto you’re going to get scammed.
You won't send cash to someone you don't really trust, would you? How is crypto different? With paypal you get some "security" with the tradeoff that sometimes you won't get it(i.e you get scammed either as buyer or seller) and many times it just pissesoff both the sender and receiver using "fraud detection" and treating both as criminals.
For example, I rented a vacation home last year, on VRBO, and the highly unusual contract (that was not shared until after the purchase) made me very uncomfortable. As an aside, I was also surprised that I was billed directly by the rental company via Stripe, rather than through VRBO. I requested a refund within an hour of booking.
For two weeks, I attempted to contact the rental company. I never received a single acknowledgement from them, and VRBO provided zero support. The only way I was able to get my money back was with a chargeback, showing my request for a refund within the cancellation window.
I am 100% confident that if this had been a bitcoin transaction I would have lost that money. I would also expect a rise in bad actors abusing that lack of recourse if bitcoin did increase in popularity for payment. In my mind, that is the challenge that crypto needs to solve before it can become widely adopted as a payment option.
Yes it does introduce a third party, but the point is that compared to the current system there is no other option for the many cases in which you don't need don't want to use an escrow, the payment processor invariably act as such and can shutdown your business at will.
The whole reason these address validation and KYC measures exist is to protect against fraud. They aren't done "just for fun".
Please explain how bitcoin solves for that problem. Hint: it doesn't.
(As long as the transaction throughput and transaction fee are reasonable)
While I can understand the desire to not interact with a user of the platform (shopify, google, PayPal, etc), because of the cost, and because many are likely to be bots or actually fraudulent. It’s precisely at these edge cases when computers and automated performs the worst.
These are the situations where the scenario is imperfectly modelled in the system. Maybe the engineers didn’t think of the edge case, or an ML model never had training data to cover it.
Point is, it doesn’t matter. People problems need people solutions. Remediating edge cases involving people’s livelihoods strikes me as most likely a people problem.
When you’re asking a person or company to trust them in a business relationship into the future, such as by being their shopfront, there’s only so many you can destroy before word gets around. I haven’t used or recommended businesses to use PayPal for a decade, because I saw them time and again inflict pain and financial stress with no recourse.
As another example, look at the general sentiment around Google Cloud. Would you build a business on top of it? Does that include an exit strategy to multi-cloud, because you’re unsure if they’ll support the service you use?
If you can’t scale to provide a human to help other humans caught in the edge cases of your own system, then you need to acknowledge you’re causing harm.
A dog food company that kills a puppy every week, is really a puppy killing company that sells dog food.
It’s a matter of perspective yes, but if you got into it to help feed dogs, surely the last thing you would want to do is harm them?
And if you became aware your killing puppies, would it not be the top priority to ensure it never happens again?
Customer service escalation confirms its not possible to take funds out without bank link.
Instead of refunding 5k to customers and asking them to inconvenience themselves by paying again via ACH, we had to open a new bank account.
I repeat.
I went as far as opening a new bank account with a new banking institution that would be solely used to link to PayPal.
Do not link paypal to any core business accounts. You really should segregate your core business accounts from any linking, stripe etc or yodlee-type service, if you can help it.
Let the payment relationship be between your bank and your customer bank only.
No middle man. No surprises
It's not like a small business where the owner themselves can guarantee high quality services
Nobody at Google or Amazon will ever be fired for writing code that bans a few too many people, or labels legitimate users as fraudulent. It simply does not harm the company at all. A few people here on HN talk about how their small group went with an alternative, or they personally de-google'd, but for the rest of us, the option is cross your fingers and hope or just do what will happen when you get banned anyway.
We've been running e-commerce for the last six years, and have tried everything (woocommerce, open commerce, bigcommerce, magento, prestashop).
They are all light-years behind Shopify.
We've had bumps along the way with Shopify as well (similar problems to yours).
A few thoughts:
- Know who you are in bed with : Shopify Payments is actually Stripe Platform in most locations, and PayPal in Europe. We refuse to work with PayPal because of their predatory behaviour, so we choose not to use Shopify Payments in the EU.
- The Shopify Payments platform is for better or for worse a "start without friction, KYC later" experience. Be aware of what this entails.
- Get on RocketReach, find key people in Shopify relevant to your problem and send a succinct email asking for assistance. It's unblocked every problem we ever had
- Do the same with your merchant processors : Edwin from stripe actively reads HN, and can often provide assistance on Stripe related issues.
- Get lawyers. Not the Go-Sue-the-Pants-off-everyone lawyers, but business / commercial lawyers. Not only can they provide excellent advice for your business, they often spécialise in these types of situations to have conversations and results that you can't access individually.
At the end of the day, know your business partners and establish a relationship with them.
Using a combination of the above, we've survived competitors using fake C&Ds against our processors and platforms, amongst other things.
I couldn't see any backend option to select the preferred Shopify Payments backend processor, but would be interested if you have insight into how to achieve this.
In what gives weight to the GP, we enabled Shopify Payments, confirmed it went through PayPal and switched back to Stripe to avoid the "process with PP for a week and then have them freeze your funds for 6 months" grind.
When you say you're running ecommerce - you mean your own shop or building ecommerce solutions for others?
Their App Store is the biggest, which as we know from apple, it is quite important for your ecosystem. You want an advanced inventory tool? A 3pL? A new packing slip app? A new discount app? Any of the best apps out there that are actively developed are integrating with… shopify.
lets say a bookstore goes out of business and I buy their stock and sell it in my own store. Do I need proof that I have legal right to sell those books? First sale doctrine is established law - your discomfort with 'fake' books has nothing to do with anything - no one said anything about counterfeit goods. They're asking them to get some 'proof' they can sell merchandise they bought to sell.
It’s a free market. There are plenty of other online platforms to choose from that don’t care whether or not they sell fake garbage. You can also create your own online store if needed.
Apt username
If Shopify can provide that assurance to me - I will transact on Shopify-hosted stores more with confidence.
Shopify, in contrast, stays in the background. For the most part, unless I recognize the checkout flow or see the shoppay option, I, as a customer, don’t even know that Shopify is involved in a transaction. I’m not buying, in any material sense, from Shopify.
https://www.ft.com/content/cff23e36-b507-4717-8830-8b06741c8...
I agree with others in this thread - they should provide a layer of actual humans to help shop owners. And have a process for dealing with AI/ML gone rogue - like the address verification system in this example - where a set of humans can override and make sure a shop owner can continue to operate. Heck send someone to PR to help validate addresses every month.
Platforms will want to be safe, and will content block up-front, meaning it's the user who has to prove the legality of what they are selling. Good luck with that (as the Twitter thread demonstrates).
The stories I've seen appear to come under two scenarios.
1. A new developer builds their first app (significant up front time investment). Upon submitting their app, Shopify bans their account giving some vague reason such as 'developer's name matches that of a known terrorist' (are names globally unique now?) or 'we believe your business presents a level of risk that we will be unable to support'. Shopify doesn't explain beyond that, and further communication is impossible. All the developer's hard work and trust in the platform comes to nothing, and Shopify doesn't care.
2. Existing developers with successful apps are suddenly delisted from the app store or even shut down entirely. New installs are not possible. Shopify refuses to explain the reasoning. Months pass without any resolution as the developers lose users and revenue.
In the latter case, many partners suspected that these apps were being delisted due to competitors paying for services to flood their app with fake positive reviews, knowing that it would lead to the app being delisted. I don't what came of this situation; whether the matter was finally resolved or those affected just moved on; as I've seen nothing since (this was about 3 months ago). Shopify gave a few vague acknowledgements in Slack along the lines of 'we are taking this seriously, but can't offer details', but nothing more. The casual and/or secretive way Shopify dealt with these cases (where a developer's livelihood is at stake) makes me very worried that I could find myself in a similar situation at any time.
It's not even act first, ask questions later. It's simply act, case closed.
Shopify wasn't always like this. It's a recent trend.
Happened to my wife, who has an extremely common name, when ordering something online and the shipping company blocked her package. infuriating…
https://nitter.net/mattzollerseitz/status/154199435652101324...
Maybe it's what you're used to.
(Dead inside and being sarcastic, btw)
If someone buys your product for $100 and Stripe's fee is $3.20 and you issue a refund to someone you will refund the user $100 and Stripe keeps the $3.20 so that refund really cost you $3.20.
If you had a deal where you were directly exposed to all the fees involved, what I'd expect is that you net fee on a transaction would be composed of fees from three different categories.
1. Per transaction fees that apply to both charges and refunds.
2. Fees proportional to the charge amount that apply to both charges and refunds.
3. Fees proportional to the charge amount that only apply to charges.
On a charge you'd pay the fees from all three categories. On a refund you might get back the fees from category #3 you paid on the charge, but you'd again pay the fees from category #1 and #2.
For example if you sell an item for price P and the fees from the three categories are F1, F2, and F3, your net gain on that transaction is P - F1 - F2 - F3. A refund transaction has a net gain of -P - F1 - F2 + F3. That would bring your total net for the combined charge/refund to -2 F1 - 2 F2.
This we should expect some net fee for a charge followed by a refund. For small transactions that net fee could be up to almost twice what the fee was for the charge alone.
Most processors though don't directly expose you to all the fees. That's because there are a bazillion different possible fees with each different subsets applicable to any particular transaction. So most processors expose a simplified structure based on averages over a large number of transactions across similar merchants. Most merchants prefer that.
When doing such a simplified fee structure, they could set charge fees based on the average for F1 + F2 + F3 and refund fees based on the average F1 + F2 - F3. But refunds should be much less frequent than charges, so it seems find to me when doing a simplified fee structure to just average the refunds in too, and just deal with fees on the charge side of things.
Your information is outdated. PayPal keeps the fees now. https://www.theverge.com/2019/9/20/20876570/paypal-refund-fe...
If there wasn't, seems like it would be a slam dunk lawsuit.
I also dont understand why they continued to use shopify if shopify was keeping their money.
The rest of the thread notwithstanding, this is not what First Sale Doctrine does, at all!
So it sort of is what first sale doctrine does. shopify is asking them to produce proof they have authorization to sell something they've already purchased and need no special rights to sell, regardless of whether they're branded or not.
They're selling books and even soaps with "deadwood" in the name, and they / the publisher (sounds like they're both run by him?) appear to have directly lifted the photo for the cover of one of the books:
https://mzs.press/The-Last-Western-Deadwood-and-the-End-of-A...
...from here: https://deadwood.fandom.com/wiki/Deadwood_(episode)?file=Sea...
My guess is that Seitz got nailed by trademark and copyright infringement claims and is now spinning a story about how his poor poor book shop is getting screwed over by the Big Evil Corporation, as witnessed by the very histrionic language he uses in his tweets.
> ...
> (3) use of the mark does not suggest sponsorship or endorsement by the trademark owner
https://www.inta.org/fact-sheets/fair-use-of-trademarks-inte...
I'm not a lawyer, but "Deadwood Soap with a Prize Inside: Dirt" sounds like it could suggest sponsorship or endorsement to me.
Of course, as teh_klev pointed out, this most likely isn't the cause of the store's Shopify problems since HBO says they're OK with what the store does.
Right, but it doesn't make it illegal, as stated by the seller, for Shopify to have these requirements.
I'm giving the seller full benefit of the doubt that they were not selling anything that violates copyright / trademark law. The point is the doctrine still doesn't make Shopify's request or requirements illegal.
Just like a web forum banning you for posting something annoying is not a violation of your constitutional freedom of speech.
The current law and constitution don't protect you from these actions.
Since shopify doesn't actually tell them what items are an issue, it is requiring them to compile a full accounting including 'proof' of their ability to sell all of their items within 48 hours, or else suffer financial consequences when their store is shut down.
So it doesn't involve the constitution, but rather its shopify's unreasonable and unexplained policies and vague threats that are causing financial damage to this small business owner, demanding something that might not exist at all, because no special rights are required to sell 'branded products' legally purchased, and shopify will not specify what the issue is, so demands such an accounting for the entire store within an unreasonable length of time.
These seem to be saying that:
> I’m gonna have an update for you later today on my continuing communications with @Shopify. They are now asking for purchase receipts to sell Star Wars books on their platform. This is both illegal and nonsensical.
https://twitter.com/mattzollerseitz/status/15425335496891310...
>As detailed higher up in this thread, neither Shopify nor anyone has a legal right to demand documentation in order to sell, resell, give away, or otherwise dispose of published material, according to the First Sale Doctrine. Big thanks to Twitter mutuals for hipping me to this.
https://twitter.com/mattzollerseitz/status/15455428048600145...
>I responded with an email restating that the First Sale Doctrine makes such a request both nonsensical and illegal, and asked a few more questions.
https://twitter.com/mattzollerseitz/status/15455428184243609...
>"All of this was not only unnecessary but illegal as covered by the First Sale Doctrine."
https://twitter.com/mattzollerseitz/status/15455452242351308...
I agree with you that what Shopify is doing is bad and doesn't make sense. Freezing or taking money might be illegal. But I would think it's not illegal for Shopify to ban an account due to some system flagging it as suspicious, because I assume the Shopify TOS say they can do that.
https://en.m.wikipedia.org/wiki/English_rule_(attorney%27s_f...
Is it a guarantee? Absolutely not. But it can work, and if the amount of money involved is too small to make involving lawyers worthwhile, it's often your only remaining option.
How else would you suggest handling the situation of needing to recover $7000 that a company owes you but they refuse to acknowledge your existence?
Was just toying around with porting a friends very successful shopify store to another platform .. noticed the main home page weighed in at 89MB .. wowza. [ To be fair a lot of that was large pngs which are much smaller as jpg or webp ]
Scrolling thru the endless html/css/js page sources injected plethora of 'liquid' inclusions, I can only describe as otherworldly.
Top offenders were essentially 2048 pixel wide png photos which should have been 1024 wide jpgs at max - weighing 6MB instead of 250k for a difference the human eye probably cant detect : )
but.. more than that, just an endless stream of js html css inclusions .. I suspect 85% of which is dormant, 20% actually repeated, if I were to guess.
hehe
We actually have a problem figuring out the exact amount of time their access token stays valid as it seems random, from a week to a month to 3 days.
Many people running brands, either professional digital marketers or small business owners, have absolutely no concept of page weight. I continually fight battles about this with the various ecomm brands my employer owns, and yet when a marketer updates the home page content somehow we still wind up with 20 MB above-the-fold autoplay movie files.
An e-commerce site on which I have 4weekly subscriptions of multiple products has an astoundingly bad UX ... and it's driven by Shopify. Either Shopify's recurring order system is fundamentally broken, or this particular site is misconfigured.
In either case, it's a deficiency of Shopify.
Please quickly name your top three. Then we can check the veracity by seeing how they get dissected by HN pundits.
The wholesale store functionality has customer based price lists. I've also added products to cart with a discount amount as line item property, which is then picked up and discounted by line item script. Some concern there with people manipulating it but I think it's pretty theoretical and there are ways to combat that. Both those require Plus though.
They announced the new backend pricing API/web assembly script thing a couple weeks ago that seems like it will solve this issue for real.
Similarly to how the subscription stuff was pretty janky with apps until the selling plan stuff. That said, it got the job done even if it wasnt ideal, and now they have a good solution. I prefer that model to just rolling out a bunch of half baked features.
Responding more to the parent than you now, but in most cases if a business claims to critically need some specific feature, I wonder if they are not just married to the specific solution they have in mind and not the underlying problem. But if they really do need a specific thing, then certainly looking for the platform that offers it makes sense.
I am curious if anybody has suggestions for good alternatives to Shopify for building an online store?
Shopify is one of Stripe's largest customers and a very heavy influencer of their roadmap (example: Stripe Treasury, BillPay (coming soon!), and more!)
Grocery stores have been out of all sorts of products this year and the normal response isn’t “this is an outrageous failing of Kroger” it’s “Kroger isn’t able to source Wheat Thins because of various supply chain issues.” Same story with everything in the tech sector.
If you went to McDonald’s and they couldn’t process your order because Visa banned you then that’s not really on them. Or in a more individual level you probably don’t get told “well you should have picked a better car supplier” when you call off work because your car breaks down. Customers are also pretty understanding when shows or channels get yanked due to contract disputes.
The bigger issue seems to be that it wouldn’t have mattered who they went with and any financial institution would have yanked them after getting a chargeback from their bank.
These examples are different from white labelling.
On the other hand, this book store hired Shopify, via ShopPay, to handle payments. The good and the bad now belong to Shopify. (I'm not claiming to judge fault)
There's a level of trust that you have to have with a service provider over something like a grocery store.
If you're at a grocery store, and your card is declined due to Visa blocking you, you did not lose out on money. If you're selling things on Shopify, and have shipped orders that you're expecting Shopify to pay you for and they do not pay you, there is now a loss involved.
With that said, just because you're not the one processing payments doesn't mean you're not the one holding it.
At some point, governments need to step in and regulate this once their customer support to customer ratio drops below a certain percentage. Otherwise it's a form of tax that creates extreme victims and its usually the small customers because big customers can always pick up the phone and call someone.
Admittedly, it's hard to be an intermediary, because the sheer amount of fraud you there. These companies become, due to liability etc. a kind of 'financial police' which isn't their role.
And then have to do that for every little jurisdiction.
I suggest that there needs to be way more transparency about their own terms, and paths to redress grievances.
But probably we need to change regulations a bit as well for e-commerce.
I got scammed buying a NAS from a smb electronics shop recently. No one will ever know. No one cares.
Logically I think it's far more likely that big companies are compliant because they operate so much in the open and are under constant scrutiny. Every disgruntled customer has the potential to go viral and do enormous damage.
With the most empathic sigh: Shit happens. At big corps most of it. Relatively, probably not.
There should be an option for a payment provider that is a credibly neutral protocol.
Other options (BTCPayServer) are available, but they need more work to integrate.
Shopify charges additional 1% per transaction for 3rd party payment integrations. Weird.
As for why people don't self host, it's likely just easier not to. You start off on an easy platform because who knows if your business is gonna work, then the business grows and you're already on there so why self host when it's working right now? And you continue down that path until it doesn't anymore.
We have a lot of suppliers all over Europe and this is the 14th July. To say that we are angry would be a gross understatement.
The only problems I had were solved with a few phone calls, as I had a bank manager very interested in doing business with the company I was working for.
But I was not in the USA/EU when I did this stuff, so I have no idea if Stripe and co. have improved things or not. For me (I later moved to Europe) it was a massive regression.
Of course they will only currently work in the EU, but fast, reliable, cheap direct transfer systems might be a model other countries could implement. The benefit is that banks (at least in Europe) are quite a bit more regulated than e.g. shopify and random lock-outs like this shouldn't be as common, or at the very least should have clearly defined escalation mechanisms.
In terms of customer protection as well, direct debits are super nice here in EU.
EDIT: aand get downvoted by HN crowd, how unexpected :)
And second, even if you want to accept onchain payments, current onchain fees are something $0.2 for confirmation within an hour. Which seems reasonable for having final settlement without any intermediary of your funds this fast. Compare this with traditional payment options like credit cards where you are waiting often times 30 days or even more for settlement and as the OP illustrates, you are at mercy of intermediaries.
You’re being downvoted because it’s a bookstore that sells to the general public. Less than 1% of their customers would know how to pay with bitcoin, and even for those who do, they would likely keep their bitcoin and hold them right now since it’s at a 1-year-low instead of using it as a currency.
It’s just not helpful to the situation. That’s why you’re being downvoted.
Such a state is incompatible with a free society, unless you redefine restrictions on freedom as only what is done by the government. A definition that is little comfort to businesses bankrupted by unaccountable corporations.
I personally don't agree with "modest" but having two (or more) classes of corporations to divide laws and regulations between seems like an obvious step in the right direction. Right now there seems to be "monopolies" and everything else. Obviously Amazon or Shopify are not the same as a family owned business; treating them as such should be the exception not the norm.
I would probably try to start with just making fairer appeals processes and such (some sort of third party arbitration system, in this case, is probably better than just companies getting to set their own individual and opaque and hard-to-comply-with policies).
So I've been told. What I haven't been told is how telling a spammer that they were banned for spamming (instead of the opaque "breaking terms of service") helps them evade detection in the future. They already know they were spamming, and can be 99% sure that's what they were banned for. It's only the innocent that don't know what they did wrong.
You're arguing against a suggestion no-one has made. I'm proposing to tell them what they did wrong, not how they were caught.
"You're being TOS'd because your email titled 'Foo' on the 3rd of July breaks our spamming rules" tells you that your email titled 'Bar' on the 2nd didn't, and you know what you did differently between them and now you know how far you can push before being caught.
It's a bad situation - ideally good actors could get useful feedback to help avoid accidentally crossing a line, but bad actors will absolutely abuse any kind of margin thy can find.
Why are Internet platforms unable to do that, other than it's too much of a hassle and makes our business unsustainable? Which may be a legitimate reasons for the platforms, but are not legitimate at all for society as a whole.
The issue is that you can't use the standard, low cost venue for small b2b disputes (this one was over $7,000): the local small claims court. Most contracts will stipulate a convenient venue to the author of the contract (which may cost more than $7k to litigate if you are out of town). Federal court requires a bigger injury and won't hear your case. In many jurisdictions, business cannot self-represent in small claims, so even if it is available, it's expensive. You end up hiring outside counsel, even if you have lawyers as employees which raises costs a lot, and opens up the possibility of a suit where the awarded legal fees dwarf the amount in dispute.
or do you worry about actually enforcing an arbitration decision?
The answer to consistent bad behavior can't be "well, just sue!" because the US court systems are already underfunded and jam packed as is. It just doesn't work to (only) have breach of contract lawsuits in David v. Goliath (202X) suits.
*THE SYSTEM WORKS AS INTENDED*
Anytime someone suggests a good idea like this or says "we should" you need to go back to the root of the problem. The system is designed to give all the breaks and funnel all $ to the top. That is the way corporations want it and they own the politicians.
This isn't government incompetence or some idea that you came up with. This idea will not be implemented because it would benefit the 99.5% to the detriment of the 0.5%
Put a banner up on your site saying the shop is down temporarily, rebuild a barebones version of the site just for ecom, etc.
Shopify needs to do better, but I can’t help but question the business decisions made by op.