Stripe has decided to nuke my entire business | Hacker News Reader

Stripe has decided to nuke my entire business

1,624 pointsyaythefuture678 comments

Saw https://news.ycombinator.com/item?id=32261868 from a couple weeks ago and figured I'd share my own story.

3 weeks ago, I woke up to a pissed off customer telling me her payments were broken. My startup uses Stripe Connect to accept payments on behalf of our clients, and when I looked into it, I found that Stripe had decided to deactivate her account. Reason listed: 'Other'.

Great.

I contact Stripe via chat, and I learn nothing. Frontline support says "we'll look into it." Days go by, still nothing. Meanwhile, this customer is losing a massive amount of business and suffering.

After a few days, my team and I go at them from as many angles as possible. We're on the phone, we're on Twitter, we're reaching out to connections who work there / used to work there, and of course, we reach out to patio11. All of these support channels give us nothing except "we've got a team looking into it". But Stripe's frontline seems to be prohibited from offering any other info, I assume for liability reasons. "We wouldn't want to accidentally tell you the reason this happened, and have it be a bad one."

We ask: 1. Why was this account flagged? "I don't have that information" 2. What can we do to get this fixed? "I don't have access to that information. 3. Who does? "I don't have access to that information" 4. What can you do about this? "I've escalated your case. It's being reviewed."

I should mention at this point that I've been running this business since 2016, my customers have been more or less the same since then, and I've had (back when it was apparently possible) several phone conversations with Stripe staff about my business model. They know exactly who our customers are and what services we offer, and have approved it as such.

After a week of templated email responses and endless anxiety, we finally got an email from Stripe letting us know that they had reviewed the account and reactivated it. We never got a reason for why any of this had happened, despite asking for one multiple times. Oh well, still good news right? Except nope, this was only the beginning.

This morning I woke up to an email that about 35% of my client accounts had been deactivated and were "Under review", the kicker here being that one of those accounts is the same one they already reviewed last week! This is either the work of incompetent staff or (more likely) a bad algorithm. No reasonable human could make this mistake after last week's drama.

So currently, my product doesn't work for 35% of my customers. Cue torrent of pissed off customer emails.

And the best part is, this time I have an email from Stripe this time: Apparently these accounts are being flagged, despite the notes on our file, and despite the review completed literally last week, as not in compliance with Stripe's ToS. They suggest that if I believe this was done in error, I should reach out to customer support. Oh, you mean the same customer support that can't give me literally any information at all other than "We have a team looking into it"? The same customer support that won't give me any estimates as to how long it's going to take to put this fire out? The same customer support that literally looked into this a week ago and found no issues!?

I feel like I'm going crazy over here. These accounts have hundreds of thousands of dollars in them being held hostage by an utterly incompetent team / algorithm that seems to lack any and all empathy for the havoc they wreak on businesses when they pull the rug out from under them with no warning, nor for the impact they have on customers when they all of a sudden lose all ability to make money. And all that for an account that has been using Stripe for nearly 7 years without issue!

This goes so far beyond "customer support declining at scale." If lack of customer support means that critical integrations start to fail, that's not a customer support failure, that's a fundamental business failure.

View on HN

Used to work for a “high risk” payment processor, we inherited tons of accounts that were terminated by Stripe, Square, and PayPal. Here’s one small bit of inside info that may help the newer businesses out there:

Most real payment processors (e.g. banks, merchant services companies) “underwrite” a company BEFORE allowing them to process. Underwriting means they look over the business model, financials, etc and make sure the business is an acceptable risk, not doing anything illegal or against their terms, etc. So you’re more likely to be declined initially, but if you’re lit up, you should be good for the future because the underwriters actually saw the deal and approved it.

While I haven’t worked for these other companies, a lot of experience seems to show that Stripe, Square and PayPal operate differently: they light up ANYONE, and then only underwrite when the account hits a critical threshold of revenue. So it’s easy to get an account there, but if you scale up, that’s when you’ll be scrutinized and potentially terminated. It’s a very unethical practice because it ends up hitting businesses at the worst possible time, when the termination or suspension causes a huge financial hit.

So basically, always have a backup processor and use these web based services at small scale to prove out your model, but NEVER rely on them as your sole payment solution.

Great post, thank you. Makes sense. Have applied for stripe myself, and was amazed there weren’t more hoops to jump through. I guess they eat the risk until a threshold, as you say.

seriously you should write this as a blog

(or if you are trying to be pseud, let me interview you and I'll write it)

if this is SOP it's important information

I’m curious what benefit you think publishing the comment as a blog post would provide over the existent HN comment (which also has its own URL: https://news.ycombinator.com/item?id=32855106). Possibly better SEO?

I don't think it's unreasonable to think that a blog post has an easier time gaining traction than a HN comment outside of HN users.

How, other than SEO? If you want to share a link to it, you already can.

More that you can go deeper in context / detail, with images, styling, better links

Name a blog post that has stuck with you because you learned something useful. Could you search for it and find it easily? Now do the same for an HN comment.

I'm pretty confident I could find any HN post that I remember with the search box at the bottom, or by googling it with site:news.ycombinator.com.

With, half of the blogs that I liked I can't remember the name of the blog, it's probably either been dropped from search engine indexes for being older than a year or two or pushed to the 10th page by better SEO, or the site has simply vanished.

OK, I have little doubt that many readers of HN could find something here, but I think that for the vast majority of people finding a blog post will be a lot easier than an HN post. Styling will be an obvious advantage, you will be able to take a very quick look at a blog post and be able to remember if it's what approximately you saw before or not. You will need to read at least partially through an HN post to gather if it is the wrong one and reject it.

That’s usually easy using Algolia when you have sufficiently unique search terms, but otherwise that’s what I meant by SEO. Any other reasons?

Rich-embeds in social media/communications platforms, mostly. Simply taking up more space in a Discord/Slack/Teams/$SOCIAL channel with a bold title, an excerpt, and an image adds visibility, context and is more interesting to the viewer.

A link to an HN thread is opaque, uninteresting, and context-less.

I've literally never seen a link to an HN comment go viral on social media, such that my non-HN friends would read it. It happens for blog/medium/substack posts all the time.

But for what reason? The styling?

Definitely. HN is suspiciously devoid images. To most people on the internet in 2022 that alone makes it wholly uninteresting.

I often wonder how the site survives without sticky autoplay videos popping up halfway down the page and covering 80% of the content...

Surely it's due to the mobile application that HN is always pushing. And the invasive tracking. And the paywall. And the ads, the ads go without saying.

The ads keep HN alive. But because each one only needs to sell "one product" (the job they're hiring for) nobody hardly notices them.

It uses images for the upvote/downvote arrows, the Y in the header, and the spacer gifs in the table layout (yes, HN uses table layouts)

HN reads like grumpy old tech and finance guys in Dockers pants and Alligator t-shirts stuck in 2000.

They're alligator polos, you rugrat!

> I've literally never seen a link to an HN comment go viral on social media

I've never thought about this, but now that you've pointed it out, I'm realizing this is genuinely a fantastic feature.

Sounds like yet another of the many perks of the spartan design here. All substance, with just a hint of (cascading) style.

More detail?

Good question. Feels like there's two Qs in there: 1) when is long-form better than short form, 2) why write about problems at all?

2. Why write at all: consensus drives policy change, and information drives consensus. Writing, of any length, assembles information, bundles it into an argument, and (if the argument lands) becomes a 'capsule' around which consensus can form.

1. Why long form: room for nuance and research. Long form can include different perspectives (including stripe's -- perhaps they have a reason for these practices). It can address questions like 'what % of the industry behaves this way, what are the downsides to the banks' approach'. The interview + editing process can tease out anecdotes that sharpen the argument, or uncover new aspects of the problem.

This part is selfish, but for the writer, long form lets you improve your own knowledge of the topic, and your ability to make arguments around it.

Ok, I thought you meant publishing the same text as in the comment, but as a blog post. So what you actually meant was “please expand on this in longer form”. So “blog” not necessarily as a publishing medium, but as a genre of text.

People outside of HN are more likely to click on and read a link to a blog post than a link to a random HN comment.

A blog post also feels more trustworthy than a random social media site comment.

Shocking, I know.

Would appreciate this blog or further deep dives; I’d like to take it to legislators and regulators demonstrating a regulatory gap.

What specifically is the regulatory gap here?

'due process' concerns around sudden blocking of routine traffic -- should platforms give notice, are they required to justify the ban in terms of their TOS + enforcement history, what is the time scale of appeals, can customers appeal to an independent body, and reporting transparency for enforcement

This. If you’re providing financial infrastructure, there should be exception recourse versus customers having to come to public forums to beg for help. You know, like banking regulation.

The “gap” is a customer choice though. I ran payments myself in 1999 and had to get a merchant account and deal with the bad APIs of the time. People can do this today. Or use Stripe. Not a great choice, but still a choice.

Agreed this deserves a blog post. Very interested in best practices around providing payments.

This explains all the mysterious and opaque decisions that are regularly posted here by affected businesses.

Thank you for sharing your insight!

And don't they use a bank's services so they don't have to go through the normal 'if you're going to be a bank' scrutiny? I'm guessing that they have a requirement from the banking service to vet anything that would normally need underwriting otherwise.

> a lot of experience seems to show that Stripe, Square and PayPal operate differently: they light up ANYONE, and then only underwrite when the account hits a critical threshold of revenue.

Sounds similar to how subprime lenders doled out the mortgages without any due diligence. They skimmed their bit off the top in transaction commissions, but later dumped them before they became a compliance hassle.

As a rule, there's nothing wrong about a default to accepting making deals with strangers.

And that's the only thing similar in here. The payment processors are not selling anything by fraudulent claiming they evaluated their quality.

What they do have is a very bad customers service that is prone to a different kind of crime (withholding people's money) and create a very unique kind of risk they don't communicate to their customers.

I'm pretty sure this would be considered a deceptive business practice by most courts of law. You can't just straight up lie about the terms of a business agreement - i.e. if you say you've evaluated a customer's creditworthiness but you really haven't I think there is a very good argument that any agreement was not made in good faith, however, Stripe's ToS probably requires mandatory arbitration, etc, so I'm not sure what recourse you have as a customer.

Arbitration doesn't mean no-recourse or bias toward to the provider.

Arbitration does absolutely means a bias to the party that requires it. You can't have a long-term relationship with a company and not acquire some bias.

Even if the arbiter is pure and just the company will learn how to represent its side in the best light before the arbiter; it has many chances to learn.

The other side has one chance to learn.

Right, think about it as a consumer. I don't want a gas station to run a credit check, or ask for proof of employment before I fill my tank. They just accept the card. But that does mean they bear risk for chargebacks if the card was stolen.

It's also the exact same model that private health insurers used before Obamacare. Do minimal underwriting unless someone gets really sick, then scrutinize the hell out of it, even offer bonuses to employees based on how many claims they find reasons to deny.

Did "Obamacare" do anything to end this phenomenon? That hasn't been the experience of people I know.

Yes. Everything is guaranteed issue unless you go with one of those weird Christian health insurance things. Insurance companies can't deny coverage now because of a pre-existing condition, and they can't go back and deny claims because of something someone put on an application. No one gets their insurance dropped because they get bone cancer and THEN a claims adjuster went and poured over their original application.

https://www.kff.org/health-reform/issue-brief/pre-existing-c...

"Before private insurance market rules in the Affordable Care Act (ACA) took effect in 2014, health insurance sold in the individual market in most states was medically underwritten.1 That means insurers evaluated the health status, health history, and other risk factors of applicants to determine whether and under what terms to issue coverage."

"Prior to the ACA’s coverage expansions, we estimated that 18% of individual market applications were denied. This is an underestimate of the impact of medical underwriting because many people with health conditions did not apply because they knew or were informed by an agent that they would not be accepted. Denial rates ranged from 0% in a handful of states with guaranteed issue to 33% in Kentucky, North Carolina, and Ohio. According to 2008 data from America’s Health Insurance Plans, denial rates ranged from about 5% for children to 29% for adults age 60-64 (again, not accounting for those who did not apply)."

I also learned the hard way to never rely on a single payment processor. It was an expensive lesson. Of course, being thick-headed, I had to learn this lesson twice before it stuck.

Always have at least two payment processors. If you've got a lot of money on the line, get a third lined up, too.

Yep, as I was reading OP's story I kept waiting to get to the part where he switched to his backup payment processor and life went on. My brain: "You do have a backup payment processor, don't you? Don't you??"

If you're running a business and you find that it is utterly dependent on some single point of failure, you'd think that would be something you'd want to correct ASAP.

I think the part you missed is he's using Stripe Connect and its 35% of the merchants through him that lost the ability to process cards?

I used to work in technical/customer support for an internet payment gateway. The esoterica of internet payments are pretty out there; most of the people who called us just wanted to sell their widgets -- they barely understood what we were talking about when we'd ask them where they had their merchant bank account.

... which is to say that, yes, you and I as people who work deeply in a space, of course we know this thing is a SPOF. Everyone else? They don't know that. It took me a long time to acquire the empathy needed to talk them through this stuff, but it made me a better communicator, and it helped an awful lot of them understand.

It is a hard lesson with an expensive solution.

I agree with you, as you grow, you have to diversify. However, services like Stripe Connect are more difficult and time consuming to replicate. Stripe connect handles the processing of many different accounts and handles skimming the commissions and then depositing the proceeds into the individual bank accounts of your users after doing some cursory KYC. This service is of course not compatible with similar services offered by other processors, so you will have to write all the handling logic and integrate with the KYC providers and possibly separate ACH deposit providers on your own.

In other words, there is a lot of lock-in with services like Stripe Connect.

How do you handle recurring subscriptions with this setup?

Presumably you have to get certified with SAQ D for actually storing your custopmers payment info instead of tokenizing. Huge hassle.

You use a 3rd party payment orchestration platform. Spreedly and Very Good Security both offer this and we use them for our business.

I am not familiar with this. What makes them less of a single point of failure?

They're just a tech solution orchestrating (recurring) payments to your payment processors. So they don't have to do the same checks as processors. So they are only a technical single point of failure.

All they really do is handle tokenization and pci compliance. They're not an active participant in the financial process, basically just a technical proxy. Thus no risk (to them) of charge backs or anything like that, so aside from you not paying your bill, they would have little to no reason to nuke your account.

So if Stripe is one of the best "low risk" processors, who is the Stripe of "high risk" payment processors?

Cash.

There is no such thing. High risk means high transaction costs, high underwriting costs, and lots of insurance/legal/compliance work.

Your best bet is to pay the slightly higher fees by going directly through your actual bank.

Right, but who's got all that and an easy API and SDK? i.e. if you were willing to trade off higher fees for safety and slowness of ramping up in a compliance sense, but you do want quick dev ramp-up, who do you use?

You can try CenPOS [1] or tempus [2]. Both are easy and fairly quick to implement.

[1]https://www.elavon.com/industries/cenpos.html [2] https://www.tempuspayment.com/default.aspx

Thank you. Definitely a bit harder than Stripe. I understand the difference now.

CCBill

The difference is between the company having their own merchant account with a bank (which is what most large companies do) using an online payment gateway, and not having one and leveraging the processor's instead (which is what Stripe, Paypal, etc provide). When you apply for a merchant account you get that approval and underwriting, but with a hefty application fee for obvious reasons. If your payment gateway shut you down, you can just switch to a different one, but there'd be little reason for them to do so. Your bank is much less likely to shut you down, because you were preapproved. The main reason would be for high fraud/chargeback percentages.

When you use Stripe or Paypal or similar, you don't apply for your own merchant account. You make transactions using their merchant account. If there's a fraud or chargeback percentage issue, the banks will have a problem with them, not you, but it also means the service needs to be proactive in policing their clients so the banks never come after their merchant accounts.

When starting up a company, use a Stripe or a Paypal to get up quickly, but probably ramp up to using multiple quickly, so you have backups. As your revenue increases, apply for a merchant account and move your transactions over to that. There is an upfront cost, but the processing fees are significantly cheaper, and no one will pull the rug out from under you without quite a bit of correspondence. Even when using your own merchant account, you can find processors who will handle all the credit card input and transmission on their end instead of on your site, which greatly limits your PCI compliance requirements. Regardless, when you build your service, abstract the payment process such that you can easily add or switch providers. Don't be married to a single one, because at the least you should be switching to a merchant account when the application fee is lower than the transaction fee percentage difference.

Source: I also worked for (and was the principle developer of) a high risk payment processor, providing a processing gateway for individual merchant accounts serviced by an ISO. We tried to look at becoming an IPSP (I think that's the acronym), letting customers leverage our merchant accounts like Stripe or Paypal do, but it was significantly more work and process with credit card companies than we wanted to deal with.

Interesting. What will be the provider you recommend? Any local banks?

Unfortunately I know little about the process for actually applying for a merchant account or where to get it from. That's what the ISO we partnered with handled. Also it was "high risk" accounts (cough adult cough), that is different banks than you'd be using. Same with the competitor payment processors I'm aware of. If you're unfamiliar with the process and can't find a bank to walk you through it, an ISO is not a bad idea. They'll walk you through the process and help you find a bank, and also a processing gateway. They'll also add a margin on the processing fee, but it's not a big one, and certainly less than paypal or stripe.

For processors starting out, there's nothing wrong with using Stripe or Paypal etc. When you ramp up to using your own Merchant Account, Authorize.net isn't too bad as long as you're not doing recurring payments (those get tricky), or maybe even Rocketgate.

I think the best solution here, is add a payments orchestration solution to your stack.

There are others, I know of this spanish startup integrating with stripe.

In this way,you can have both your bank TPV/ Payments and Stripe working alongside, if any fails just put the other, or the one giving better prices by default, etc

https://monei.com/es/features/payments-orchestration/

If someone uses WooCommerce for their store, they have 79 different payment integrations, including Stripe, Paypal, Amazon Payments, along with merchant account gateways like Authorize.net. Some of them are paid extensions but rather cheap considering the use.

https://woocommerce.com/product-category/woocommerce-extensi...

What Im talking about is to add another abstraction layer, so you can have both payment processors and decide which use on the fly, both integrated with any ecommerce framework you use

You're still going to have some grief is you sign up 2 years worth of customers to recurring subscription via Stripe and then have them pull the rug out from under you. Sure you can switch to your backup processor(s) for new customers, but you'll need to go back to all your existing subscription customers and ask them to re sign up to their recurring subscriptions with the new processor.

Its much harder to engineer a payment abstraction layer with recurring payments where you're not relying on Stripe's subscription features that are not migratable to another payment processor.

When building out your business, you need to look for possible points of failure, assess the risk of each point, and then consider mitigations.

Payment processing is a possible point of failure. Chances of it failing? I think anyone who's read HN/Reddit/etc would have to evaluate the chances as fairly high. Cost to the business of it failing? Often extremely high.

Having done this analysis, you can look at mitigations: sign up with both PayPal and Stripe, get a merchant account, etc.

Then build the redundancy into your system. Yes, this probably means you cannot use the fancy features because there's no good cross-provider abstraction. That's the cost: you might have to implement recurring transactions yourself.

This happens over and over again. Your individual business is worth basically nothing to your cloud provider, your payments provider, your CDN, your domain registry, etc. They do not care if it breaks.

You have to have redundancy for anything you cannot operate without.

Maybe the abstraction can be a selling point for your customers. They can sign-up for the recurring Stripe subscription but it comes with the risk of suspension. If they are ok with it, atleast they can't claim "I didn't know this" if/when it happens (this risk can be included in the contract to deal with executives leaving/"amnesia"). Or they can also have redundancy, which of course costs extra but can be thought of as an insurance and the abstraction does the rest.

If in fact High risk is necessary then NMI is the most common gateway. Be careful they require a rolling reserve and can require multiple buckets capped at a certain amount, commonly 50k / month.

We write a few a high risk accounts per month. As a matter of fact I just had a call center run across my desk a few hours ago.

Exhaust all underwriting options as each processor has a different risk tolerance. For instance this call center is now using NMI and a rolling reserve, I've found another processor (one of the big 5) that will not fall under the High Risk thus saving a boat load not to mention negating the accounting nightmare that comes with rolling reserves and high risk processing.

Spreedly is a very good provider for this.

Yes thank you, couldn't remember their name

This seems sound for one off transactions, but I'd be interested in how to make this work with subscriptions, assuming you don't want to take the PCI burden of holding the raw card details - is it a case of asking all your customers to resubmit their details to the new payment processor?

I guess in the case of the orchestrator you linked they retain the card details and can then charge using any of n processors, though I'd be interested in thoughts from the overall thread where people are advising to be ready to change payment processor

Thank you for bringing the "payments orchestration solution" term here! Have something to learn about.

American Express and Chase. I have both and they are awesome... so far.

One thing that is almost impossible to do on your own is to get a merchant account that you will be using to process payments on behalf of others. So if that is your business model, you are almost certainly in for the fight of your life with banks and merchant providers, along with some stupidly high reserve funds.

Stripe makes this super easy, but it is a house of cards based on stories like this one. So I agree, you still need to get your own merchant account, and not rely on stripe as you get larger, but depending on your business model it might be taking more of your time generating due diligence documents than an acquisition.

Yes, this is why my previous company never went the IPSP route (letting customers accept payments with your merchant account). They are incredibly arduous to get approved, you practically need to have a bank CEO as your godfather to get it. Also you need to be at least PCI Level 1, which involves actual auditors going through your business and policies. That part is significantly easier than the IPSP though. OP doesn't sound like they were trying to do that though. They talk about their client's individual Stripe accounts being turned off.

This is probably what a business like OP's would need to do. When their customers are small, use a processor like Paypal or Stripe. But as customers get larger, OP should probably do what we did: partner with an ISO, who can get the customer their own merchant account. OP still does the processing for them, but the risk and finances run directly through the client, not OP. The ISO can also add in a margin on the transaction fees for OP if that's part of their business model.

More specifically: if you're in the business of processing payments on behalf of others, you actually have "bank" as a core competency / requirement of your business model and need to make your plans accordingly (or carry the added risk of having your core business model outsourced).

What magic wand do banks possess that enables them to declare-into-existence a merchant account, anyway? I mean in a technical sense, not a legal sense. What are payment gateways and other banks seeing, that allows them to know that a particular merchant account X is a "real" account, that can be targeted with credit card payments, rather than a made-up one?

Is there an X.509-based hierarchical bank registrar system for charge-origination signing certificates, for putting charges onto the card networks? Is there a DNS registry of merchant accounts for pre-checking charges before attempting them? Do banks underwrite other banks into existence by signing their certs?

Banks have a whole lot of bank laws. While mostly it is paperwork, it also means some trust and responsibility that can be used to do things that banks do fornon banks like process money. Check with the local laws. The law protects customers of banks at the expense of the bank, which is what you want customers to know before using you for bank like things.

Pretty much none of that. What exists is a whole lot of money, a willingness to lose that money if a bank makes bad bets on the trust and security of a customer, a bunch of laws to adhere to, and willingness to go to jail if those laws aren't followed (or, perhaps willingness being the wrong word, an understanding one will go to jail if those laws aren't followed and protected parties lose money as a result ;) ).

In short, it's a different category of risk than the category that an individual business or even a business that is acting as a middleman for transactions takes on. And it's a different category precisely because most of the solutions aren't technical; they're legal, social, and financial. If a bank gets screwed it just gets screwed; even if the law intervenes to deal with transgression, money is often just gone as a result of such fraud. So they are comparatively more conservative in their decision-making.

What is a "large company" in this context? My employer is on track to run about $5m through Stripe this year, which will be our fourth full year using Stripe. Our first year we did about $2.75m. This year I've been getting occasional emails from a Stripe sales rep for the first time, which suggests that we've crossed some sort of threshold...

Your stripe transaction cost is probably around the advertised fee, 2.9% + 30¢

With an actual merchant account you can probably get closer to 2% or at least 2.5% + 25-30¢

At 5 million in transaction revenue, a .5% decrease would be 25k a year. You can probably get a larger decrease depending on how much risk your company's business has.

Stripe's sales rep might be contacting your company because you've hit the threshold where it's probably worth getting a merchant account, and they want to see if you're considering leaving to give you a discounted rate to stay. You're pretty much in Stripe's retention department because of your volume. It is definitely worthwhile at this point for your company to shop around for a merchant account. Some don't even have application fees if you're not a high risk business. At the least they can get an idea of how much they could save, and use that to leverage lower fees from Stripe.

I would still consider trying for a processing gateway that handles all the card transmission, though, even at a slightly higher margin. Handling the card at all means you need PCI Compliance. At your revenue you're probably PCI Level 2 or 3, which only requires a self-assessment questionnaire (that is lengthy but doable), and a quarterly vulnerability scan. At 6 Million transactions a year, you'll be PCI Level 1, which means you'll need an auditor to come in and look at your processes and policies.

Stripe will offer interchange plus model so you are actually paying the real interchange rate + whatever they tack on for settlement probably 25 basis points and some fixed rate of 0.05 a transaction. You shouldn’t be paying a blended rate if you’re doing significant volume.

If you’re using a gateway, there are some that Handle tokenization so you never have to touch the PANs and you don’t have to worry about PCI levels and audits. There’s no reason your systems should be touching PANs unless you’re really large and using multiple payment processors for scalability and redundancy like if you need to process a million transactions in a few hours.

thanks much for the tips!

Had to verify this information.

https://www.merchantmaverick.com/what-is-a-merchant-services...

Seems what they posted above is accurate.

Costco Merchant Services did exactly this to us way back in the day( 2007-ish?). We switched from our previous merchant account bank due to better rates near the beginning of that year.

Everything was fine, up until right after Thanksgiving. This was an ecommerce company, so a sudden 500% increase in authorization volume is pretty normal and expected. Well, not to Costco ( or rather, the bank whose services they were reselling ). Our account was immediately deactivated, and we ended up having to spend a week begging our previous bank to reactivate our previous account.

That first night was, personally, an all-nighter writing janky code to encrypt cardholder data with ephemeral keys and store it off-database on an isolated, firewalled host (in order to pass the PCI-DSS SAQ coming to us in January), ship the product anyway, and hope that we'd be able to authorize a reasonable percentage of that unauthenticated cardholder data in the future.

This is what happens when you make business decisions based purely on price -- or in the case of Stripe, developer convenience.

Costco or Elavon ?

Why those web services don't leverage from the fact/data that a real bank has already vetted you? And you use a real visa/mc/ae cards. They anyway block you.

This is how an auto insurance company I used to work for wrote policies. They didn’t underwrite them until there was a claim and then they would rescind the policy and deny the claim when they found a “material misrepresentation”. They called it underwriting on the back end.

This seems like straight fraud.

What company!!!??? Please don't just leave all of us hoping we aren't the unlucky guy that is using that company.

I wouldn't be surprised to find it is most insurance companies. The insurance industry as a whole is seriously messed up and congress seems unwilling to do anything about it.

> I wouldn't be surprised to find it is most insurance companies.

In the U.S. I guarantee you that most insurance companies are NOT doing this. What this company is doing is called "Bad Faith" in insurance jargon. And the penalties for this sort of behavior are enormous, and can even include the possibility of the company losing its license to sell insurance in a particular state.

> The insurance industry as a whole is seriously messed up and congress seems unwilling to do anything about it.

Congress doesn't do much with insurance because insurance in the U.S. is regulated at the state level, not the federal level.

LOL, wait until you hear about ERISA and learn that everything you just said is wrong for most employee insurance plans and that you can't even get damages when they act in bad faith.

> LOL, wait until you hear about ERISA and learn that everything you just said is wrong for most employee insurance plans and that you can't even get damages when they act in bad faith.

We may be talking past each other here. I was referring to property and casualty insurance in my comment, while it sounds like you're talking about health and disability insurance. Two completely different worlds and regulatory frameworks.

Fair, those are definitely much more fair but just a quick search will show there is no shortage of courts ruling in insurance companies favor even when acting in bad faith. Just looking at complaints on the insurance commissioners website for my state seems to indicates even when they do get fined the amounts are small.

It's half true. There's not really underwriting for auto policies like there is with life or home insurance. You register your rating rules with the state and anyone who qualifies gets a policy. All the risk calculations and pricing are just look up tables and done automatically.

Now if you are in line for a large payout the insurance company will definitely review your application to see if you lied. Significant lies will get your policy cancelled and no payout. So don't lie on any insurance applications.

Thanks! This makes sense of it.

Come on give us a hint or maybe just the company mascot?

Sounds like private health insurance.

Initial form questions like "tell us if you have ever been to hospital for anything serious?", you're thinking "I'm not sure if that time I dropped in to the GP 5 years ago with a headache counts as serious [same for other things that seem trivial over the years, just being sensible]".

You phone the insurer to check, they say "oh there's no need to put that down, it's not meant for trivial things, you'd have to write an essay in a small box if we meant literally anything conceivable; don't worry about it". You couldn't possibly hope to remember every tiny thing over the years anyway, unless you had access to your various written medical records held by various parties.

10 years of premium payments later you make a claim because you now have MS, you need support and treatment, a brain scan confirms physical issues, and..... "your policy is invalid because you didn't tell us about that time you went in about a headache 15 years ago". They still keep the 10 years of premiums though.

You take them to court. Your lawyer mentions that this is extremely common practice by health insurance companies. They don't provide you with any way to confirm if your policy is valid until you make a claim, then it's too late. You did what you thought you were supposed to do. The lawyer says most people who then take the insurer to court are unable to prove they were misled, and the insurer keeps the premiums you paid despite not providing any actual insurance.

Don't ask me how I know.

I am not surprised.

I am disappointed the American people is simply putting up with this healthcare situation. I don't think it matters if your doctors welcome room is fancy. Or they have 10 administrators replying to you within minutes. In the end you want to be treated fast and efficiently, and it fails. But I digress.

I can see why paypal does this and I am glad we are planning on avoiding them in our back end.

Huh? That sure seems like fraud, unless there are details I'm missing here.

>It’s a very unethical practice because it ends up hitting businesses at the worst possible time, when the termination or suspension causes a huge financial hit.

You forgot the part where Paypal get to keep your money when they close your account. And it's not like they only keep it temporarily in case of lawsuits/chargebacks, they just keep it forever. I still can't believe that crap is legal.

Are you saying you should empty your account constantly (nightly?) in case paypal gets shut down your account, for unknown and un-communicated reasons?

> Are you saying you should empty your account constantly.

When I was involved with taking payments through paypal that's what we did. For us there was no value in keeping payments in there but there was plenty of risk. We stopped using them very quickly though, their fees were ridiculous.

yes. the paypal horror stories were very common and frequent ~10 years ago. that's how Braintree, Stripe, etc. got started.

Nb PayPal has owned BrainTree since 2013.

You probably already knew that, but for the benefit of anyone reading this who didn't.

There is even a feature called auto-sweeps that can be requested via support to enable automatic daily payouts

Yes, absolutely. Some banks offer "sweep accounts" that do this automatically. If they have to come to you to claw back some money, they're more likely to tell you why.

>Are you saying you should empty your account constantly

This doesn't really help. When you link your bank account with PayPal the link is 2 way. I.e. PayPal can, without any input from you, transfer money out of your account. They can even do that if the account is empty. Your bank will almost certainly allow an overdraft on your account and you're still liable for the amount + overdraft fees.

I had some issues with PayPal about a year ago and a senior rep at my bank talked me through these details.

With my bank, it wasn't even possible to turn off the overdraft feature.

Bottom line is, PayPal almost always wins.

You can upon sign up of any bank account not allow overdraft. In fact it is an opt-in feature, that depends on your bank they communicate properly with you. I have for instance ensured there is no overdraft added in our business accounts.

Or perhaps I am missing something here?

But yes, please remove overdraft from your accounts. I have no input to offer on paypal at this time.

P.S. Are you in the U.S.? I am just really surprised they bank deemed overdraft as a necessary feature in your case. I am personally interested in this case.

I'm in Australia, there is no way for me to remove the overdraft.

Which bank is that? Seems very strange that they would do that, personal or merchant.

Not quite the same situation here, but overdrafting is a rather nasty feature in my experience. As a student I used a debit card to simplify my banking do I wouldn't have to think about how much money is in my account (if I'm unsure, simply send a text to get my balance or transfer); if I didn't have enough money in my account to buy a $10 lunch, then I wanted my transaction to fail, for budgeting reasons. This didn't work for two reasons:

1. Overdrafting. My bank would not allow me to turn off overdrafting on my checking account; any money in my savings account would be used to cover an underfunded purchase from my debit card, causing a $25 fee and there was nothing I could do about this, short of closing my savings account or reducing the amount of money in it. Since free checking was dependent on a linked savings account with $500 minimum balance, this wasn't an option. The overdraft/fee could cause the savings account balance to go below the minimum, and if I didn't notice I'd get a $25 fee for my savings account as well.

2. The school would constantly charge my debit card as a credit card, and the transaction wouldn't appear for up to two days. Doesn't really help me keep track of my balance when transactions don't show up. Cashiers at the student store could usually process the card properly, but every time I bought something to eat at the cafeteria it would process as credit, regardless of what I told them.

Today, I think bank policies have changed (though I switched banks before this) and I believe you can disable overdrafting on most large banks (WF and BofA, anyways)

You know what's better than learning from your own mistake? learning form other people's mistake.

If you login during a vacation overseas and get your account locked, they keep everything in it. Doesn't matter if you never did any transactions yet and all that money is yours from the bank account you linked. If you get banned, you lose it. Getting your account and/or your money back is about the same level of difficulty as getting unbanned from a google account. It's not impossible, but be prepared to take them to court.

If you only use PayPal to purchase things online, the protection is great, but you don't want to be on the other end of that transaction.

I've had my Paypal account frozen because I was cheating by living in a different country, not just on holiday. I managed to recover it by giving them the documents they wanted to "prove" that I lived in the country my account was in. I think this included getting my bank to send statements to a family member's address and have them email me a copy. I know some people really do get locked out for good but that wasn't my experience.

Trying to get money from a real bank account (Lloyds in England) after moving out of the country was much harder though. It involved writing several letters and getting a policeman to stamp something, as well as multiple phone calls, including to several staff who gave me wrong advice. But still, they returned my money eventually.

they still have $4k from me, I just gave up on it.

Added benefit, those real service providers, banks, cannot let you hang for that long without repercussions. Especially if it is reasonably sized business accounts and clients they have quite an incentive not to. Not all rosy of course, but much better it seems than those oyhet payment providers.

FWIW, PayPal tells you that if you expect to run a large business with them you should call them and escalate yourself to underwriting BEFORE you massively scale something up that might cause them to flag your account; and so, unlike with Amazon Flexible Payments--which did screw me over soon after I started operating--I never had issues with PayPal, as I followed their process and thereby had an assigned sales agent who could negotiate with underwriting from the get-go.

My company uses Stripe among others. We do on the order of 8 figures of transactions over all our payment channels. Not a whale by Stripe's standards, but not nothing either. We also have enterprise agreements in writing and signed contracts with all of them. It wasn't necessarily an underwriting process as far as I know, more of an enterprise software licensing agreement. But either way, they are obligated to provide services under the terms of the contract. The terms include some commitment to future use and get us at least a smidge of discount off their fees. As much as startups love buying services with transparent pricing where you just pick a service level and plunk down a credit card, when it's business critical, just call their biz dev team and ask for a contract.

While you can enforce the contract later, does it save you from the algorithm and "I don't have that information"?

Honestly, idk. It at least gives you grounds to seek redress via legal channels in the case that you do lose business. I'd hope that the threat of legal consequences makes them be a little more deliberate in their actions.

This has been very informative. My gratitude to everyone who has elaborated on how underwriting works with these providers.

> Most real payment processors (e.g. banks, merchant services companies) “underwrite” a company BEFORE allowing them to process.

Sounds like there's an opportunity for a Stripe competitor that businesses can somewhat trust to not pull the rug, though that'd be quite the bootstrapping process.

I had a very similar experience, except it was on our launch day.

We hadn't charged a single live customer yet, but we had done plenty of tests using the Stripe testing environment. So we go live with a huge launch event, and we have customers signing up in droves. When they get to the last step -- payment -- they get an error.

Logging in to the dashboard I didn't see any indication that there was anything wrong with our account. No alerts or notices. We had already gone through the approval process you go through when signing up, and been told we were approved.

The thing that surprised me the most was that there was just no indication anywhere that our account would not be able to charge cards. Wouldn't it make sense for there to be an indicator somewhere that just says "Not ready yet"?

Apparently, they had never even begun reviewing/vetting us since the time we signed up for the account months earlier. We reached out to customer support and it took them about two weeks to get us activated. And, similar to OP, they never gave us a shred of information about what was going on. I still don't know to this day what the issue was.

Next time I build something with Stripe I'm going to test it in production before launching, with my own real credit card!

> Next time I build something with Stripe I'm going to test it in production before launching

I'm genuinely curious why you wouldn't have done that anyway? I pretty much always do, precisely so I can experience a full end to end user experience.

I mean yes, shame on them for not charging themselves $1 or something in production, but still, it's insane for Stripe to have no indication on the dashboard that you're not actually able to charge real cards real money.

Buying your own products inflates revenue figures (and is therefore pretty much prohibited in listed companies). Many investors don't like it either.

Sure, you can do it, but you'll have to forever have a note in your accounts package saying 'this revenue isn't actual revenue'.

It really upsets those who want the accounts to match up to the cent at the end of the year...

I smell a made up problem. Do you really think the CEO of Chipotle can’t buy a burrito from one of their branches without accountants getting a heart attack?

They just walk in and buy one. They in their personal capacity end up richer by a burrito and some invaluable experience. The company ends up richer by the price of a burrito. If this kind of “revenue inflation” matters to anyone then either the CEO has a bad burrito addiction or the company wasn’t transacting enough anyway or both.

Where I worked, the CEO would walk in and get a free burrito. It's another kind of headache (technically that burrito is pay, and needs to be taxed and declared as CEO pay), but that was considered preferable to revenue inflation which is fraud rather than dodging taxes.

This is were some fucking common sense needs to break out. If the CEO at a food chain cannot legitimately eat there like a regular customer, then we've got some jacked up bullshit regulations. If the CEO is driving to each branch and order 1000 items, then sure, that again should be common sense of something.

More and more, we just keep acting dumber as "tech" is more and more engrained

The CEO buying a burrito and paying for it with their own money because they want to eat a burrito is not revenue inflation. I can't even imagine what kind of fantasy world you would have to live in to believe this rubbish.

Debit revenue, credit employee expense claims, journal entry: adjustment for test purchases made. Pretty standard, doesn't affect your numbers at all, no need to make any note in your statement (which you wouldn't have to do anyway because it'll never meet the threshold for materiality). Its not some sort of difficult accounting problem.

Yes, exactly. I would think that reversing charges raises a flag with whatever payment processor or bank that sees it.

There's no need to reverse it even, just go through your standard expense claims procedure or product refund procedure.

Stripe advises against that (I'm not saying it makes sense)

"Do not use real card details. Testing in live mode using real payment method details is prohibited by the Stripe Services Agreement. Use your test API keys and the card numbers below."

https://stripe.com/docs/testing

Frankly that's a ridiculous clause. If you make a change (like switching from testing to live in the stripe dashboard) it needs to be tested, as OP's comment nicely demonstrates.

It's bullshit. Anyone with experience testing things in this area is 100% gonna try a real card at least after any major changes (and certainly before a launch of a new product). You aren't actually sure it's right (and so, with something so entirely connected to revenue, can't go the fuck to sleep) until a real charge has gone through.

They probably mainly just don't want people running shitloads of automated-test charges and issuing refunds for all of them. It may technically be against the TOS but there's no way they actually care if you run the occasional real-credentials test, especially if you don't refund it.

Refunds used to be free, but for a few years now Stripe keeps the transaction fees.

Although I guess doing lots of refunds would mess with anti-fraud and other systems.

I just do special pricing/discounts to do a $5 transaction (too small could look like credit card fraud).

> especially if you don't refund it.

That's the trick. Let Stripe put the money into your bank account and let them think its a real sale (not a production test), then refund the money out of the bank account back to the person who's card was used instead of refunding or reversing the charge. Stripe don't need to know about that.

(You also owe yourself "due diligence" in knowing that you _can_ refund or reverse charges, so you'll also do that test in production as well, but don't make it one of the first transactions you ever do in prod. I try to stretch that test out until after a 60 day window past the first few dozen real sales have gone through, under the assumption that by then Stripe (or whoever) will have seen a bunch of payments go through and not be challenged when the CC statements arrive, and that'll have sent some "probably not a new fraudulent merchant" signals into their systems.)

This is what my team always did for QA when I worked in a space using payment processors.

No need to roll back the transactions directly and risk flagging anything.

Plus, it's often useful having a real, live, paid and in good standing account and/or purchase in the system for further testing steps! (More true in the subscription space than the one-time purchase space... but even there... it's probably worth testing your refund flow end to end periodically eventually, once you have a healthy set of traffic under your belt to avoid standing out.)

This cause exists not for product testing and QA but rather to prevent payment details for being abused in the name of “testing”.

Everyone runs 1-3 “real transactions” as a “real customer” when getting ready for a launch with QA.

This cause exists for Stripe to point to for excuses people make when attempting to wash transaction or test stolen CC info in a prod environment (which doesn’t work with a test api key)

Run a real card for a real amount and write a check to the person whose card you used. Do this multiple times with different types of cards.

The testing doc says it's against the agreement, but from a 1 minute look at the agreement, I can't find where the agreement bans testing in live mode. Do you see it?

Others replied already, but I'll chime in too.

There's "testing"

* manual during development

* automated testing

And there's "testing"

* smoke checking processes in production

In most cases, the "test in production" is more of a "validation" that end to end experience works. And there probably shouldn't really be much of a way to distinguish between a "test" in production and a "validation" of the purchase process.

The funny part is, I thought that if I did a bunch of real transactions and then reversed them all, that our account might get flagged!

That's in addition to explaining to our investors that we ended our launch day at -$1,000 due to all the chargeback fees because some dumb developer doesn't know what a testing environment is. And in addition to the fact that Stripe recommends against you testing in that way.

I did get a full end-to-end experience, in my production environment, with literally one variable changed: using the testing Stripe API key instead of the production one.

I don't know, it didn't seem like a crazy way of testing at the time. When you consider that the testing environment worked perfectly, and there was no indication, whatsoever, anywhere that we would not be able to charge cards, it kind of felt like how you're supposed to do it.

But clearly I was wrong :) The way you find out if your account has any issues is by charging a real card, and if it works, reversing it, and if it doesn't work, waiting a couple weeks with no information on what's going on. Lesson learned!

> charging a real card, and if it works, reversing it

Why would you reverse it? If you can’t afford to consume one unit of whatever you are selling are you really in a good place to be in that business?

I guess there can be rare exceptions where the business sell only a handfull of high ticket items. But then again probably Fincantieri does not let you put your bespoke mega yacht on a card through a web transaction.

We are an internet service provider and we charge a monthly fee for our service. So the real thing I would've been doing was reversing the first month's charge and then cancelling the recurring subscription. Which is exactly what I'd recommend you do if you are launching a new subscription service on Stripe!

Just make a hidden $1 subscription and cancel it without reversing it, then deactivate the item.

I still got caught when I did that once. $1 worked just fine. The first real customer $249 charge failed. :-(

Test in production. Do real dollar value tests. If you can test with different cards with different security levels, try a Visa 3D Secure and a 2FA Amex charge. Personally I do them and then get reimbursed (or do them directly on a company credit card) rather than start out a production payment history with refunds, not sure if that matters but I figure if it does it's got to be a bad signal so I may as well avoid it.

Why not just claim the expense on your card as business expense, and pay yourself back?

Another good reason to do a Live charge even for subscriptions (add a coupon code to make it like $1 if you really need to) but is to test the credit card expiring after the fact. I've done a lot of billing code an none of the sandboxes really let you test a card that works for N months, and then expires.

> Why would you reverse it?

Why would you not? Stripe still keeps the transaction cost, so clearly they anticipate this happening.

And this is exactly what I told a friend of my to do when he installed a public car charger. Before he told anyone it was live, charge his car using his normal customer account. Turned out he couldn't create one because his phone was already in as a supplier.

After some eye-rolling he agreed to buy a burner phone, add a prepay SIM, and whaddayano the bloody charger did not work. Two months later it works, for most people, who have recent cars that are not Teslas. Sigh. "welcome to our product, you're a beta tester. Maybe an alpha tester. We hope it works!".

There are countless of virtual phone apps which allows calling and SMS for a few bucks a month. That’s what I’m doing to create “test” accounts on our stripe prod environment for something I’m building.

Yes. When interfacing with a complex system, especially one you don't control, always do at least one live test.

> reversing it

This isn't recommended. Also, presumably by end-to-end you meant post auth business flow too. Such as reconciliation, settlement, generating tax receipts, invoices etc.,

In general, all the data in production should be real, as much as possible.

If the amount is big (e.g., say jewellery story) then figure out a way to recoup/refund the money out of band in a way that leaves no trace in production system. E.g., reimburse it, put it under QA budget or some such.

Always test your life platform, doenst matter if its payments or software, always test life, i can not emphasize that enough.

Next time I build something with Stripe

I'm curious why you would still consider them a trustworthy business partner after what happened?

Exactly. After reading this thread, the chance that I would ever choose to use Stripe is exactly 0%.

What a disaster.

They might still be the best of a bad bunch. Payment processing is a de facto cartel (probably driven by it being an actual cartel at the Visa/Mastercard level).

We've been moving away from Stripe and Stripe-backed (e.g. Shopify) payment gateways pretty much everywhere we can for this same reason. We only have a few integrations left connected to Stripe, specifically one with Tripleseat, which we use for our event management and have not migrated yet. Choosing Stripe has been the most costly decision we've ever made and we're not a small company nor a startup.

What payment processor did you switch to?

Our main bulk of transactions get processed with 4 different local payment providers (Accepta, Bank Tech, Dynamics Payments, and Evertec), one of which integrates with Authorize.net, which in turn integrates with Shopify as a custom gateway. For all of them, we were able to negotiate really good fees that are half of what we currently pay with Stripe.

My recommendation is to look into your local providers and see if any can integrate with payment APIs like Authorize.net. These providers really want your business and care enough to at least not let you go bankrupt. The bar is low!

That's how AMEX shut us our corporate credit card account overnight. We launched a new shopping cart and tested it live in production with our own AMEX card. Mind you that we used that card for over $250k a month (never a late payment) and this was a $99 charge that we simply forgot to refund.

No appeal process, nothing. Caused significant short term cash flow issues. So be very careful using your own card.

AMEX used to have major issues with consumers trying to "pay" themselves — the Singapore version put me in financial review for a PayPal transaction that I had accidentally paid to the wrong address, and was subsequently cancelled and refunded — which to AMEX looked like I was trying to "pay" myself.

I don't know if that's still the case, but these days I'm wary about using AMEX on any sort of money transfer service.

I'm surprised there is a next time.

I think that's the biggest thing I see on this thread. That Stripe gets the chance of a next time. This validates what Stripe is doing to developers.

"What is water?"

I just played that video at an outdoor movie night. It gives me the feels every time. Great video!

Same happened to me a year ago. My customer was on a tight schedule to run a trial, and postponing the launch on the launch day because of Stripe ruined their trial.

This is bad.

There are more and more Stripe horror stories like this, and from an outsider perspective it looks awfully like PayPal behaved back in the day (probably still does but I'd never touch it again as a merchant).

I have positive experiences with using Stripe in my last startup and we're currently building Stripe integration on another, which will process about 50% of our revenue (the other payment method being direct wire transfer).

There might be just a tiny minority of people that end up treated like this, but with every story, I'm less confident about our move.

I have personal knowledge of more than one instance where stripe totally screwed over small companies and simply decided to ignore any contact for more than half a year, withholding the money and putting everyone in limbo.

yeah, im sure its a minority of accounts at stripe, but seriously, do not take the chance!

Not to mention the several instances where pc will come into threads like this and outright lie about reaching out to customers, or will ask them to reach out then ghost them again, etc.

Do you have specific examples? Not to imply you’re wrong, I’m just curious

There is no way they ignored legal service.

Op speaks of calling and emailing and reaching out … instead, pay your lawyer 30 minutes and have the letter hand delivered to their legal department.

I can’t predict what will happen but it won’t be ignored.

In the contract with stripe I can guarantee there's a "we can do anything we want" clause. The solution to these issues is functional government so we can regulate out that language and hold entities responsible.

yeah.. in the real world people cut their losses rather than sue the company a gazillion times larger than themselves, in foreign juristictions etc.

But I seriously ask anyone, how important is processing payments to you? what do you suspect the chances are? would you prefer to go through a bit more hoops upfront with a non-stripe alternative, or roll a 1/100 or even 1/10000 dice that one day you're just gonna be royally screwed over?

I have seen it happen very close, so I know my choice. It always "only" happens to other people... until it happens to you. Its easy to say "yeah.. they were doing shady things, I dont", but when the algorithmic gods determine you to be shady, no mere mortal, except perhaps a couple of very influential people lurking HN(cough edwin cough) will do anything. Will you catch his eye? is it worth the risk?

ANYTHING you depend on, spend serious serious time doing vetting, making sure its proper, and I would say, for the love of god, make it someone you could go visit physically.

Shopify has treated me in this exact same way. No customer service.. no response.

That's because Shopify Payments is just a front for Stripe. We've seen both sides at our company and they behave exactly the same.

It could be called the fintech compliance cycle. They start out with a single compliance officer (who is equipped with not much more than the OFAC list) and no identification requirements other than name and email. Then they get lots of customers due to how easy they are to use and how they don't arbitrarily steal your stuff like Paypal. Eventually they get a letter from some government agency telling them to implement "best practices" because one of their customers did something bad. Then in order to make the government happy they go and buy fancy screening software and hire a bunch of compliance monkeys who go around causing trouble like that described in the OP. At this point they are just a smaller version of Paypal and have very little reason to exist.

The worst part about these type of cases is not being able to get a straight answer. There is a whole subset of big tech that has taken the "you must be a fraudster therefore we can't unfuck the situation" approach to customer support.

It's an arms race with fraudsters that eventually sucks in legitimate businesses.

IMO it is not the "you must be a fraudster" logic as much as "we have enough other customers that we can burn you without much worry of repercussions".

As much as I hate government intervention in business, it really seems like there needs to be a way to force companies to actually be direct, accessible, and reactive in cases like this. I went through something similar with Venmo randomly locking my account after I received a large-ish payment, and not getting any real action or sense of urgency on their side.

This seems similar to anti-trust in a way. Taking a wider view of anti-trust, the goal is to keep the market healthy by ensuring there are choices available to consumers; there are no unhealthy monopolies and anti-competitive practices. Well, as a consumer I would like to be able to choose tech products where I can get effective support. Customer support is lacking in some markets, it's not healthy. The anti-trust fix is to bust up a company, but I don't see how that would help here. This is a new economic problem where dominant companies are run by computers and algorithms that serve 95% of the people, but if you're in the unlucky 5% you're screwed.

>it really seems like there needs to be a way to force companies to actually be direct, accessible, and reactive in cases like this

That's what SLAs/contracts are for.

Yeah, I had a trouble with Wise (formerly transferwise), with a rather large payment. The annoying thing was they delayed the payment of the 10% deposit, I sent the contract, approved, and then a month later they held up the balance as well.

I still love them. That issue aside they allow me to have a personal and business account in multiple currencies, and don't screw me on the exchange rates.

Not to put on too much tinfoil but the government probably benefits from opaque ban processes in large oligopolistic private companies. “It’s private enterprise, sure we may request it periodically but their cooperation is entirely voluntary based on their civic pride.”

I think it is called GDPR in Europe

Depending on amounts, small claims in the US might be viable.

> we have enough other customers that we can burn you without much worry of repercussions

This. This is a common tune to about 100% of "BigSomething killed my business" stories that appear on HN almost weekly. If you go to BigSomething, you get a polished, automated, convenient, cheap service that would not hesitate to kill you account the moment something looks wrong to any of the robots watching it, and the customer support (the non-robotic kind, I don't count "we are working on it" auto-replies) is not part of the package because it doesn't scale. You have to either accept this as the risk for doing business, or not use BigSomething as you primary or critical vendor.

Making competition easier in this space is another way to solve it. If Stripe had 15 competitors all of whom were API compatible so you could switch in 5 minutes, any bad PR would drive customers away in droves.

Government has made entry to this space hard which is why there aren't enough competitors, so they're really the source of the problem.

Might be time to build an analytics.js equivalent, but for payment processing. A single API lib that you can then use to process payments with Stripe, Braintree, etc.

Government hasn't made entry to this space hard, the banks that Stripe partners with have. Because they don't want to deal with high-risk transactions. They are the gatekeepers here, and Stripe has to bend over backwards to make them happy. They'd much rather burn individual customers, than jeopardize their entire business.

Certain banking regulations make those transactions "high risk".

Some of them are due to government regulations like 'don't launder money' and 'don't process money for illegal activities'. Which are, like, basic operations of society 101 level stuff.

Others (adult services) are not due to government regulations, they are there simply there because banks don't want to deal with chargebacks.

The crime of "money laundering" was invented out of nowhere one day. Society predates it by thousands of years.

+1 "Oceania Has Always Been at War with Eurasia"

And that day was less than 100 years ago. "Money laundering" as a concept was invented during the Prohibition (as were a lot of other private rights violations) in order to not let alcohol sellers - which the government was not able to prosecute directly - to use their money. But most of the current US AML regulations are based on the Bank Secrecy Act from 1970.

> Some of them are due to government regulations like 'don't launder money' and 'don't process money for illegal activities'. Which are, like, basic operations of society 101 level stuff.

Except the operationalization of those rules is: here are some vague guidelines that you have to follow, and if we don't like you we'll retroactively decide you were committing a crime even if you followed those guidelines to the letter. See HSBC for a case in point.

> Some of them are due to government regulations like 'don't launder money' and 'don't process money for illegal activities'. Which are, like, basic operations of society 101 level stuff.

No, that's wrong. Firstly, as others have pointed out, society long predates any such notions.

Secondly, determining what is illegal activity, and putting a stop to it, is ostensibly the job of law enforcement and the courts, not the bank.

Are we still pretending that USA government is a distinct entity from USA's large corporations? If the banks didn't like the regulations, the regulations would change. If some random elected official didn't like how the banks operated, after the next election she would be an ex-official.

From what I understand, the government introduced legislation sometime in the past 20-30 years (Was it the PATRIOT act? I can't remember) - which I believe put the onus of blame on the credit card processing companies instead of the government when it came to fighting fraud.

I assume the government didn't want to put all the work in of making sure the currency they've societally coerced the world to use isn't being used for fraudulent transactions, they'd rather pawn it off onto the banks because it's easier for the government to not do anything about it.

Now the banks have been shooting anything and everything that has even a semblance of fraud with account locks/funds freezing/etc., because if they don't the government will go after them.

How does this system make any sense to anybody? So frustrating. Let me exchange currency with anybody for any reason at any time.

Being direct, accessible and reactive at scale when you’re processing billions of dollars of transactions simply is not possible.

Stripe and other companies are doing their best, but they are in an arms race with more and more elaborate fraudsters. At planet scale.

right a company that makes billions of dollars can't hire more people to staff up their risk/compliance/fraud teams

That does not scale with the fraudsters. To have zero situations like OP is describing, Stripe would need to linearly scale its support team with the number of fraudsters, which would make their business simply non-viable.

This would be the same as saying: I want zero car accidents on the road, so I'll scale the police headcount linearly with the number of reckless drivers.

This could be a simple regulation - put a burden of proof on the company, and a prescribe escalation process with comment from the customer at each stage.

I hate seeing comments like this because Stripe’s hands are tied here. Anytime a bank or payment processor has frozen or shut down an account and you’re getting stonewalled it’s almost guaranteed to be an AML related issue and it’s against the law for them to tip a customer off that their account is being or might be investigated for suspicious activity. This isn’t Stripe deciding that you’re a fraudster and so you’re undeserving of help. This is Stripe doing business in compliance with the law. I’m not saying that makes it acceptable but if you’re upset about the behavior described in this post call your Senators and Representative to complain about the Bank Secrecy Act and the USA PATRIOT Act; they’re to blame for this sort of frustrating non-response.

Sure, and my experience is outside finance (more spam and fraud prevention).

Even if it is government under the hood you have to know what you're accused of. Not American so I doubt the US political system is interested in hearing from me, but I agree that's the only way of solving the deeper AML problems.

> Even if it is government under the hood you have to know what you're accused of.

This is exactly why the whole process is suspect. The government farms out the policing of certain financial crimes onto the financial institutions as a prerequisite for operating the business. If the government came along and froze your bank account you’d have a right to ask why and a right to get some answers. But instead the government pawns the responsibility off onto businesses and then prohibits those businesses from telling you why.

And so the BSA and Patriot Act effectively allow the government to take your property and take away your right to confront the government about why they took your property. And it’s all on merely a vague suspicion of misconduct. No proof whatsoever.

I can’t help but laugh at the irony— the federal government laundering their otherwise unconstitutional activities through the banks.

I'm trying to understand your position here:

You think AML/KYC laws, as they currently exist, are unconstitutional?

edit:

That's a fine position to have, but it's a fringe one, and I don't think you should be offering it as a reason why Stripe does what it does that's generally accepted by everyone else.

No. I don’t think it’s unconstitutional which is why I said “otherwise unconstitutional”. And you’re (perhaps deliberately) completely misunderstanding and conflating my two comments. I am quite confident that OP’s problems with Stripe are AML related which is not at all a “fringe” position.

> I am quite confident that OP’s problems with Stripe are AML related

I'm curious as to why you think that? Is this a way way more common thing than I expect? Or is "My startup uses Stripe Connect to accept payments on behalf of our clients" a raging red AML flag I don't recognise (I've never done that, so it could easily be)?

I’m confident it’s an AML issue because they’re getting stonewalled which is standard operating procedure when a Suspicious Activity Report has been filed. I don’t think using Stripe Connect is the red flag.

The thing with SARs is that they tend to be cascading as OP described. So if I (innocently and totally coincidentally) do a transaction with someone who has been flagged for suspicious activity my account might now be flagged as “higher risk” for suspicious activity and will be monitored more closely.

And, if they decide they’ve found suspicious activity in my account then everyone who does business with me is at risk of having their accounts flagged as “higher risk” for closer monitoring and so on.

And the bank isn’t allowed to tip anyone off because if any of those accounts are actually laundering money they might suddenly withdraw it and then the “lead” from the SAR is moot. It’s actually a crime to notify someone about the suspicious transaction(s). Which is why you get stonewalled.

Those laws certainly feel like guilty until proven innocent or in many cases, guilty no chance to prove innocence.

Exactly. Not fringe. Part of the normal struggle for existence.

It'd be unconstitutional, were the government in charge, without due process.

Interesting to notice the censorship of speech on social media is implemented the same way. The government does not remove undesirable information directly, instead it calls up all major platforms "for a chat" and tells them to voluntarily remove it, or face Congressional hearings and likely further unpleasantries down the road. An offer they can not refuse. Looks like they think they found a loophole in the Constitution and they are going to mine it for all the power they can get from it.

> it’s against the law for them to tip a customer off that their account is being or might be investigated for suspicious activity

What law do you think forbids this? In my experience running global payments through multiple rails, on an OFAC/risk ping you typically get a request for enhanced due diligence, which normally looks to the payee like “send me a picture of your drivers license”.

The most common result is that O Bin Laden (matching the OFAC list) is actually Oscar bin Laden; with further info you disambiguate the payee from the OFAC listed entity and are allowed to transact.

I have never encountered a reg that says you are obliged to ghost your customer.

The Bank Secrecy Act. And I don’t “think” it. I know it.

Which bit of the BSA?

edit: As I re-read the thread I see that I am thinking more of onboarding KYC, as opposed to this case which would be ongoing-activity investigation. So that would explain the difference in expectations here. Still interested in learning more about the regs for ongoing investigations if you have time to share!

The bit at 31 USC § 5318(g)(2)(A) under the title “Notification prohibited.” FinCEN has also promulgated confidentiality rules thereunder. I don’t have a pincite for that but I believe it’s tucked amongst their record keeping rules.

Thanks!

For anyone following along, text at https://www.fincen.gov/resources/statutes-and-regulations/ba... > https://www.govinfo.gov/content/pkg/USCODE-2020-title31/pdf/....

This is for SARs (Suspicious Activity Reports). (At least, that's the one I've encountered before, there may be other forms too).

While this is clearly "a thing", I would be a fine bottle of wine that the OP's issue is not one of those things, and is just some dumb algorithmic or overworked fraud prevention contractor problem.

I would bet that 99.9% of the Stripe (and Paypal) horror stories that get posted almost weekly are _not_ federal money laundering or terrorism financing investigations with legal secrecy provisions imposed on the payment processor.

Unless you are a federal prosecutor, law enforcement officer, or bank executive that has actively worked on a Bank Secrecy Act case, I don't think you can authoritatively state that this sort of cowboy-style, "Move Fast and Break Things" way of blitz-scaling revenues while downscaling customer service favored by companies such as Stripe has ANYTHING to do with the Bank Secrecy Act.

If anything, I would bet that regulators would be concerned about the fact that companies such as Stripe have triggered a race to the bottom whereby underwriting has become an after-the-fact exercise that can severely damage and/or kill a high-growth SME. The old way, where you filled out a ton of paperwork, provided every bit of information possible about you and your business, and then went back and forth with a human to get approval, was a much more stable way to business. But alas, when you've got former bank governors on your payroll and political mega-PAC donors on your cap table, people don't scrutinize very much.

I am indeed more than qualified to “authoritatively state this”. Even by the ridiculous standards you’ve outlined. And I would be more than happy to take that bet.

So you’re stating that you have been involved in a situation in which a merchant account was frozen due to circumstances involving the Bank Secrecy Act? I just want to be completely certain that this is the assertion?

In the UK at least, section 333A of the Proceeds of Crime Act 2002? (Disclaimer: not a lawyer)

See https://www.lawsociety.org.uk/topics/anti-money-laundering/t...

I don't think that's accurate.

I do some payments that are ridiculously suspect but legal.

I have never been completely blackholed and given robot responses, any time a problem comes up.

Stripe is lower margin than other banks/payment providers, so they don't look very hard.

They have a very strong incentive to throw away troublesome customers, which they do.

I don't think it's right to say Stripe's "hands are tied".

They could spend more to identify false positives, but they don't.

If I used Stripe for all of my transactions I would be blocked. I know this because I have 100% confirmed this from an inside source at Stripe and at a countries central bank.

Yet somehow I have and continue to maintain accounts with other banks without breaking the law.

Wouldn’t that only apply to investigations by e.g. Fincen? How many of these are just internal risk triggers by Stripe? Why would they have to stonewall you in those cases?

(Obviously it’s quite difficult to know the ratio of cases like these involving government investigations and those involving their own internal risk procedures.)

>almost guaranteed

The issue most people in this thread are talking about exists in the almost. If it was always guaranteed, then there would not be so much evidence to the contrary.

It's the YCombinator startup way: scale large enough so that you don't have to worry about customer complaints until they threaten to go public and generate enough press to cause real damage.

But in all seriousness, being a YCombinator startup is now a big red flag outside of the VC-funded bubble. My current employer, and the previous one, have strict no-YC policy for SaaS due to numerous issues with previous YC companies. And these are both tech-friendly/tech-adjacent companies.

It's even worse at stodgier companies; an executive sees "Stripe froze my payments" and that's what they remember when a Stripe salesman tries to pitch them on using stripe for their online store. Stripe is quickly becoming Google, in the bad way: it's a name people are learning to avoid, and if that hits critical mass they're dead.

This is the first I've heard about a "no-YC policy for SaaS" outside of my own employer (after three back-to-back horrible experiences) but glad to see it's catching on.

As executives and purchasing managers get more tech-aware I think we're going to see an increase in due diligence into who is running companies, who their investors are, what other companies they've invested in, etc. Brands like YC will end up getting punished (and all their portfolio companies, by extension) for the bad actors.

At which point YC will come up with an algorithm to evaluate companies and blackhol certain companies without warning or process and we'll see HN posts "YC just blackholes my business!" but on Reddit, since they won't be able to post here.

And the inevitable calls for HN to be made a public utility.

The problem is that Stripe has identified you as possibly being a fraudster. Any information that they give you about what they suspect and why is information that a real fraudster could use next time to try and evade the detection algorithms.

It is like this with virtually any security system. Adding feedback you can use for debugging also makes the system much easier to compromise.

How many fraudsters are maintaining a business relationship for 6 years? 6 years! And the OP doesn't even get a courtesy phone call before termination. That's messed up.

The answer is, "A lot more than you think."

One of the attacks that fraudsters have developed is to buy businesses to use their accounts for fraud. That going out with a fraudulent bang is better than trying to run a marginal business.

Ha! Clearnet exit scams. Kinda an obvious thing in retrospect. Of _course_ somebody was going to try it.

Part of what makes these situations so frustrating is that there's no due process, and there are significant ramifications to your livelihood. You aren't told what you're being accused of, you have no way to contest the allegation, and you might lose your entire business over a clerical mistake.

"Let the fires burn."

Onboarding new customers looks better and gets more funding than maintaining quality for existing customers, so they just don't care.

According to previous posts* this company sells something related to cannibis.

I'd love to know why certain categories are always flagged or silently banned. Cannibis, sex toys, porn, crypto, etc. Payment processors seem to always give these categories the worst service and whenever a company is nuked like this, it's usually one of these categories. Why is that? It almost feels like there's some secret government organization tasked with upholding religious values telling payment processors to fuck with random accounts and swearing them to secrecy. I obviously don't believe that, but it's equivalent to the scale of whatever is going on due to natural causes. I don't believe that these industries are prone to higher than usual fraud. So what is it?

* - https://news.ycombinator.com/item?id=32263429

Re: cannabis, it's federally illegal and you can get into serious legal trouble for facilitating payments. There have been several attempts to write legislation to fix this so state-legal cannabis operations don't have to work entirely with cash, but none have passed yet.

Re: porn, the issue is its sky-high chargeback rates.

"whatever is going on due to natural causes" lol

In addition to the other comment about cannabis, crypto is financial and comes with many laws and regulations that a payment process would need to be very aware of and follow.

Porn is ripe with fraud/theft/bad actors/etc.

It’s not a shadow government, it’s common sense.

It is a shadow government but it also makes sense.

It’s not a shadow government if the laws and policy are public. You can read all of the laws.

Basically "educate yourself", yes?

> It’s not a shadow government if the laws and policy are public. You can read all of the laws.

This is not really true. The BSA says banks have to maintain an "adequate AML program" and policies to "reasonably know your customers identities" or whatever. These policies are deliberately vague. Then based on these deliberately vague rules, banks have to make a compliance program that usually goes above and beyond the minimum that is required (in order to avoid being fined). These compliance programs that specify what kinds of behavior and transactions to consider risky are never made public.

there's no FOIA for banking processes that affect you. consumer finance protection regulations are also a complete joke (oh no, banks have to file some more reports, oh the horror).

> I don't believe that these industries are prone to higher than usual fraud.

This belief might be wrong - or at least not shared by payment processors?

Credit card processing requires a sponsor bank, and that sponsor bank sets what categories they want to process for. If you fall out of that, or the account gets reviewed a second time and someone thinks it falls into one of those categories, the account is shut down. OF almost had this happen to them because of their sponsor bank and I've seen it happen for other companies from the underwriting department (not stripe, another processor).

re: sex toys, potential felony in texas

https://en.wikipedia.org/wiki/Texas_obscenity_statute

or google "texas six dildoes"

<edit> https://www.theregister.com/2016/12/13/us_purchase_governmen...

and https://onwardtexas.org/trending/is-it-illegal-to-own-more-t...

which was posted on HN about 3 months ago and flagged.

</edit>

You could rape someone with a dildo, it is basically a gun and should be banned as such!

Cannabis is federally illegal, sex toys and porn have incredibly high chargeback rates and crypto has this handy thing where since you can't reverse anything, as soon as the crypto you bought is out of the custody wallet you cant get the thing back so the chargeback rates are also very high.

Don't believe me? Ask anyone at the front desk of a hotel the rate of attempted chargebacks for ppv porn.

You can get vetted by banks, visa and co for those things (maybe not cannabis with US companies) but the fees are considerably higher because of the chargeback rates. This is why onlyfans announced then backtracked the porn ban, visa told them "either you're paying us like you distribute porn, or you stop doing it".

If it's the case, perhaps it makes more sense to block based on chargeback rate (that's actually what payment processors are doing) instead of blocking on nature of business?

This seems incredibly obvious, and would probably be fairly easy once your business picks up volume. That or make you absorb the charge backs yourself, or via an independently-contracted insurance.

> the front desk of a hotel the rate of attempted chargebacks for ppv porn

To be honest this seems more like a hotel problem than a porn problem. E.g., I viewed it by mistake, I didn't understand the pricing, etc. I would expect that there is a similar amount of complaints about the hotel room's minibar and snacks that are lying there but charged an incredible rate afterwards if touched.

> It almost feels like there's some secret government organization tasked with upholding religious values telling payment processors to fuck with random accounts and swearing them to secrecy. I obviously don't believe that, but it's equivalent to the scale of whatever is going on due to natural causes.

Operation Choke Point pretty much worked like that.

I don't have a problem with the government fucking with the cannibis business given that it's still federally illegal, but the messing with legal businesses needs to stop.

It may be related to a general policy of burning grey market businesses that has been going on for a decade or so: https://en.wikipedia.org/wiki/Operation_Choke_Point

While I don't know what the incentives are for payment processors, they act as though they are under a quota, similar to SARs in banks, where it's mainly about showing they are getting petty crime as a means to protect their interest in partnership level crime.

Am I missing something? That thread from almost two months ago is about a completely different business. OP linked it in his initial post, mentioning that reading it was what triggered him to post this one, but nothing more than that.

Nice to see my post linked. Last time I was accused of being a shill account, however I just do not post often. :D

There’s a really good Podcast from FT on the payment issues with porn. It’s more complicated than the chargeback rates. If you want to go down that rabbit hole: https://www.ft.com/content/762e4648-06d7-4abd-8d1e-ccefb74b3... The podcast is quite a nice history wrap-up on online payments. Episode 8 addresses the current situation with credit card companies most detailed.

It looks like there's a common flaw in modern abuse detection systems: they have no long-term memory.

Stripe's abuse detection should be factoring in the age and long-term activity of the account, and support staff should be able to provide additional information to customers with established histories. Some of Stripe's policies make sense when dealing with new accounts, but a recurring factor in these complaints is that the account isn't new.

(Google's spam detection is broken in a similar way.)

I've been a low-volume Stripe customer for years. Posts like this are really increasing the urgency for me to come up with a new card processor, because I'd rather take an additional percentage haircut to get access to a dispute resolution process that recognizes me as an established customer.

long-term active accounts can get hacked. I absolutely agree with support staff needing to provide more information, but they can't just blanket whitelist any old account

They could significantly raise the threshold for automated action, though.

Did a ten year old account that does $1k a year suddenly bill $1M? Sure, flag that... but maybe give them a phone call, too.

Yes but then you can help get the account owners back in the account (another thing that companies are bad at)

Care for the customer can make or break a company. If stripe wanted big customers they can't be this careless

(and just to be fair to Stripe there seems to be a lot of customers as well that know crap about best financial/accounting/compliance practices and don't know why Stripe might have an issue with somethings)

A long term memory is nice. But we see such similar things get exploited. Like how people will get a high seller rating on Amazon selling one product, and then switch it out for a lesser product while keeping the old seller/product ratings. So the user looks at the seller and product ratings over the past year, but at the point and time they choose to buy, they are going to be burned and the bad seller makes off with the money.

Stuff like this is why I think a business should have a system that abstracts away the payment processor.

I use Stripe for invoices, but I can easily send an invoice through another platform if needed.

For processing transactions on the web, I would always lean toward using a service like ChargeBee that allows me to setup multiple payment gateways.

Getting off the ground quickly is one thing, but the moment that you have reliable revenue is the moment that you need to put some serious emphasis on redundancy across your business to plan for disasters, outages, etc. It's worth it to pay the fees to maintain a 2nd (or 3rd) payment processor once you have that type of revenue coming in.

And if ChargeBee bans you, you are still dead because that's a single point of failure. No, you should have several payment processors, and rotate them regularly to check they work.

It's been a while since I dealt with this side of ecommerce - how can you have several payment processors, and rotate them, without having to handle card data yourself? (Most folks aren't really equipped to do that.)

You use several API, attach one provider per customer to divide the risks. When one provider bails out, you onboard new customers and new payment on the other payment provider.

Then you only loose the recurring payments on the lost provider that are on hold, and you are not dying, so you can resolve that problem using a lawyer.

This is crisis management, not technical perfection that you need for those situations.

    display_cc_form_that_handles_cc_data_so_we_do_not_have_to() {
        which_one = random_number(3)
        switch which_one {
            case 1:
                display_authorizedotnet_form()
                break
            case 2:
                display_stripe_form()
                break
            default:
                display_paypal_form()
        }
    }

Plus the same integration work for each one that you'd have to do anyway (which may be little or none if you're using a platform that integrates all of them via plugins or settings or whatever)

Like maybe don't literally randomize it request-by-request, but that's how you'd be ready to use multiple processors, and you could do something a little more complex to, say, rotate which one you're on every Wednesday, or whatever. Or just have it ready so a one-line code change or config toggle switches which one you're on (that's only worse because if something's not used frequently in prod, there's a good chance it doesn't actually work, even if it once did)

It's been a long time since I've worked in eCommerce but at my last ecom role we used two payment processors and simply stored the card data with both for every customer, and the relevant IDs in the customer record in the database. Whenever anything got charged we'd check which processor we were supposed to use and off we went.

Yes this has an increased cost if your processor charges by number of customers, but I don't think that's particularly common - these two were just revenue + monthly fee.

Great solution, I wouldn't have thought of this. Did you ever get complaints about the charge description looking different month to month, or did both processors pass the same description to the customer's credit card?

I don't remember for sure (this was pushing 10 years ago and early in my career), but I don't recall any complaints of that type.

The problem is with recurring payments. If you used this approach and 1/3 of your customers were initially billed through Stripe, then if Stripe bans you then you can't charge the next month's bill through something else because you don't have the stored data for it, you have to ask them to re-enter data in another processor's system.

Another wrinkle, in practice, is that you can often negotiate significant discounts on fees, based on volume, if you've got enough of it. Yes, including with Stripe and other places that have fairly-transparent public pricing—the big-boys don't pay those rates, they pay lower ones negotiated with a sales rep.

Splitting up your payments reduces your volume with each one, which can mean you're paying higher rates overall. Or, if you go the "keep an unused alternative on standby" route, you'll likely at least have some initial traffic that pays higher public-pricing rates until you can convince them to give you a better rate, and put it in effect.

Still might be worth it as a kind of insurance premium, but it's something to consider.

This isn't "rotating payment providers", though, this is sharding customers across them. Which may be a good idea, insofar as it could reduce your blast radius, but it doesn't allow for portable customers--which seemed to be what the GGP was implying.

'pc86 has an interesting solution in a sibling comment, but I don't think you can do this across the high-touch providers, eg Stripe+Paypal.

Under ChargeBee's terms, they must provide you with your data for up to 120 days following any termination. So there's that at least.

> 7.2.3. Data Export Following termination or expiration of a Subscription, We will retain that Account’s Service Data for one hundred twenty (120) days from such date of termination or expiration (“Data Retention Period”).

I mean, ideally we need an open source PCI compliant equivalent of ChargeBee so that you can 100% own your customers payment information.

That's the way this problem really gets solved, but the security surface for that open source project is going to be a challenge.

SLAs only entitle you to a refund, not compensation for lost income. If you’re not making at least four times as much off a service as you pay for it, you really need to think about why you use that service.

Power can go out. Promises from the power company don’t fix that. Only backup power does.

Point here was that you’d hypothetically be able to get all of your data to setup an alternative if you had to, rather than just being shut down and waiting for them to fix it.

Once you trust your vendors absolutely, your company becomes their company, because they can do whatever they want with it.

What always confuses me about this is that it seems like many owners trust their vendors over their own employees and I don't even know where to start unpacking that sentence.

The problem with that idea is that PCI compliance doesn't just include the software you're running, but the infrastructure you run it on, various elements of organisational security and, of course, certification costs.

Besides being a single point of failure, we tried to switch to ChargeBee and found them to be pretty lacking (to put it mildly). The platform looks nice and has lots of options, but under the hood things seem pretty fragile. Horrible docs, random 500 errors that weren't showing on the status page (and support ignored until more customers reported it), our Stripe gateway disconnected and the system still appeared to be working (partly, partly failing) with no alerts, plus lots of other odd behaviour. To be fair, all of this was on the test system, but we didn't feel confident to go live so we put the migration on hold. YMMV of course.

Fwiw, I’m just using them as an example. There are likely plenty of other options.

That's why you need a self hosted solution.

We're built on Rails which has the extreme luxury of being able to use ActiveMerchant, which does exactly this. The problem is, abstraction falls apart when you're using functions that are specific to a product. Stripe Connect is is nearly impossible to replicate with an adapter.

This is one of the reasons that I usually use https://killbill.io/

I will definitely look into that.

Have you tried or considered lago? (getlago.com) I haven't heard of killbill, so will definitely look into them. Love that they're open-source as well and seems like they've been at it a long while.

Thank you! First I hear about either of those, but definitely interesting. Are there paid / hosted versions of lago? after a sub-par experience trying to switch to ChargeBee I'm looking for alternatives, but struggle to find something that fits our needs.

Yep there is a paid / hosted version of lago; I believe you can book a demo of the hosted version from their website and get a good 1 on 1 with one of their developers so you can see if it works for your needs.

Lago looks interesting, and promising if development continues, but nowhere near as feature complete or battle tested as Kill Bill.

Lago looks beautiful, thanks for sharing!

Yup I did this at my last business in 2008; instead of changing payment processors we abstracted them away behind a pretty small API that also stored and charged card numbers. We could flip back and forth between two. PCI DSS gradually became a bummer around that time but it was a very slow introduction which we were able to cope with.

> Stuff like this is why I think a business should have a system that abstracts away the payment processor.

Realistically, more humanly, payment processors and other big tech companies that are basically societies digital gum and infrastructure can simply not be tasked with making these calls. I also don't think they are very keen to do it but in the absence of timely regulation they must.

There have to be more rigorous ground rules (what is the business allowed to do, what must they do, what is the user allowed to do, and what are they entitled to), by law, and quickly.

But there are tons of rules and laws around payments already, and they are often the reason why providers are so trigger happy and conservative even if it means losing clients. Regulatory requirements (KYC, money laundering, sanctions) usually force them to make those calls, quickly and by design. It's very clear that most financial regulations are customer/client unfriendly, and inherently treat them with distrust.

I'm not saying that's an inherently good or bad thing... But it sure would be hard to fit both customer protections laws and service guarantees while at the same time having laws that explicitly force providers to do the opposite.

There is nothing intrinsic about financial regulations that needs to be customer unfriendly. Checks can work both ways and what happened at stripe could for example be avoided by a statue which requires a reasonable explanation and a clear path and timeline towards resolution for the customer, regardless of the company they work with.

You think stripe and PayPal are not keen to control the flow of information and business success?

I'm just starting to use Lago (getlago.com) for this. I'm not affiliated with them, but it solves the need for me for an open-source payment-processor-agnostic billing system that can easily swap between processors while maintaining a single source of truth.

But what happens if getlago.com bans you? Haven't you just moved the single-point-of-failure at a different place?

It's open source, so I can just set up my own instance. I just have to be careful to make sure that process is as easy as possible. You never know what provider may ban you so yeah that's definitely a concern, but that's why I build on only open source.

Oh wow, I thought it was a paid service! That is good! Thank you for the clarification !

You still have a Single Point of Failure. ChargeBee could shut you down too.

You are right that redundancy is important, but redundancy either in cloud vendors , payment processors or even high availability of your app takes time and effort with no immediate ROI as apposed to buliding features , better customer service.

When running a small business you always take lot of risks by cutting short processes large organisations will have. Judging which ones to take and which to mitigate is a not a easy skill, many times people get it wrong .

Yeah my “business” (just a small app) uses a third party API for tracking packages. You better believe I abstracted that API and programmed to the abstraction, so in case I ever need to move off that API I can do it very easily.

It’s not just getting banned, they could change their pricing on you or just straight up close their doors. You never want your business to be totally dependent on another company. If it can’t be avoided, get on a service contract with them.

It sucks this happened to you, but like with all the PayPal hate stories, I notice you're very careful not to describe what type of business you operate.

Does it matter? PayPal and Stripe don't advertise that they will only do business with organizations with which they agree. To accept a business as a client for a mission critical service like payment processing and then summarily cancel or suspend service without notice should be able to be prosecuted the same as someone who vandalizes a physical storefront to the point they cannot open for business. This is non-trivial and PayPal and others are acting like rat bastards to accept a client, get them dependent, and then dump them without warning.

It does matter if it actually violates the TOS, or could be vaguely interpreted to do so I guess?

And how many times does a company claim you have violated TOS and then refuse to tell you how you violated the TOS? To act in this manner nullifies the TOS in my opinion.

It definitely sucks for the merchant companies ending up on the pointy end of the TOS. But you also need to consider the payment company side of things. They face a relentless tide of fraud and shady merchants. If they are too transparent about exactly how they detect a problem, that makes it much easier for the criminals, scam artists, and dodgy merchants to get around TOS enforcement.

The real culprits here are the people trying to violate the TOS, plus everybody's desire for cheap services and easy onboarding. The historical alternative was very expensive setup (e.g., spend a few years building a relationship with your local bank branch manager and establishing a financial track record). Making it easy to get started means that most problems will show up down the road, and the lower merchant costs means less money to pay for smart people to carefully untangle the truly dodgy from accounts that just look that way.

> If they are too transparent about exactly how they detect a problem, that makes it much easier for the criminals, scam artists, and dodgy merchants to get around TOS enforcement.

I get that, but I don't see how actually telling people what term of service was violated gives too much leverage to the bad guys.

Neither do I, but I wouldn't expect to see it without really understanding the bad actors and what they're up to. So this could be their best effort. Or it could be that they're just going with a blanket "say nothing" policy because it's too hard to create a more nuanced policy that the CSRs can apply consistently. Or it could just be laziness and a lack of customer focus. It's impossible to say from the outside.

Never. In 20+ years of using Internet I have never been banned unduly from any service.

I have seen way to many stories about people claiming to have been banned for no reasons from services (online video games are a popular one) before it is revealed the ban was 100% legitimate, to take any new story like this at face value.

I was banned by PayPal once because I didn't sign up with an SSN or EIN and proceeded to make enough to trigger a review because they couldn't file a proper 1099-K on me. This was an oversight on my part and I offered to correct the situation by submitting any documentation they needed -- photo ID, SSN, prior year tax returns to PROVE that I was paying tax on the revenue coming from PayPal, the new LLC and EIN I had for that company's activity. They refused to update my account, told me to start over with a new account, and then similarly ban-hammered me again (probably because I started an account after getting banned even though it's what they told me to do!).

I made a mistake out of inexperience, was refused the chance to correct that mistake, and all of my PayPal accounts -- including my PERSONAL account that I had had for years -- were banned because they were started by a person (me) who had an account frozen or banned. Is that a legitimate enough story?

No, not legitimate at all.

PayPal had banned me because I was under 18 when I opened my account, they then allowed me to open a new one (right after this one got suspended) and it has been working fine without any issue since then (10 years+).

Stop doing shady stuff.

> Stop doing shady stuff.

If PayPal requires an SSN or EIN, why do they even allow you to create an account without one?

Because it doesn't require one. You can see the holes in OP's story. First he starts saying that he can give them an ID or his SSN and then all of a sudden it becomes a company account?

The guy can't keep his story straight for 3 lines on HackerNews, he is obviously doing stuff that he shouldn't and using his PayPal in a sketchy manner.

But at least you knew why you got banned!

Only the first time. They never told me why my other accounts -- which were following all of the rules -- were frozen.

guilt by association

Somewhere between occasionally and almost always, depending on the reason.

In most cases, you will not be given details if fraud is suspected. The reason being that companies don't want to tell fraudsters how they got caught.

Whether or not the TOS can be said to be legally nullified (not being a lawyer, I have no idea) canceling or suspending someone's account without telling them some kind of reason they can do something about is absolutely unethical.

It is also very common.

It is very common because it is not benefial for the company to clarify reasons. It includes many risks.

They can be proved to be incorrect, for exmpale if they refer into their own ToS, which is public information and binding. And then some legal expert says that this is not how it goes and it ends up into court, because customer sees risks being lower.

If they made a mistake or there was a software failure, it is bad PR.

If they ban someone for some specific reason but not someone else, there will be drama.

It is very beneficial to just say nothing.

Maybe there is a market for insurance to initiate a "Wrongful ToS Ban Lawsuit." I take no right/wrong position on the below gentleman but note that he did bring a lawsuit against Twitter for being banned and his account reinstatement coincides with a settlement of the suit. Right now the payment facilitators only have loss of an account in terms of incentive to reduce false positives in detecting fraud.

One year ago this month, Twitter permanently suspended a 340,000-follower account for “repeated violations of our COVID-19 misinformation rules.” The owner of that account, the former New York Times reporter and vaccine skeptic Alex Berenson, responded with a lawsuit demanding reinstatement. . . .

. . . Earlier this summer, Twitter put Berenson’s account back online, noting that “the parties have come to a mutually acceptable resolution.” Berenson wasted little time in calling out mainstream media for failing to cover the “pathbreaking settlement” that led to his return. . . .

https://www.theatlantic.com/technology/archive/2022/08/alex-...

They did say they had been running the business for several years and have prior discussions with Stripe about TOS on file.

Ok but is that a green flag or a yellow flag?

How many companies using Stripe have had multiple conversations about the TOS? I would guess it’s a minority. Not a topic anyone is usually excited to talk about.

The TOS can be updated/changed/clarified over time and they could end up falling outside of what they cover as a result. It's not great and sucks as a customer but it can happen.

NO, it does not in this case

They can determine up front if it violates the TOS

They can notify the customer of the SPECIFIC violation IN DETAIL, and what can be done to cure it, and provide time to do so.

They can deny access to the transaction instead of nuking the entire business for some algorithmic flag.

The Stripes and PayPals of the world do NONE of this. Instead, they act like they accept almost all businesses, get them dependent on that piece of infrastructure, then willfully trash the business on a whim.

The type of business matters if we're trying to guess whether they violated the TOS or not.

I completely agree with you that how these companies handle these issues is completely wrong, if not fraudulent.

I agree that in general, it matters.

However, by a long series of deliberate actions, Stripe has made it irrelevant to the fact that they are now deliberately, unilaterally, and with zero notice whatsoever shutting down that biz' critical infrastructure.

They could have, and should have as a part of KYC compliance, already figured out what type of business it is. If they failed at that, then fine, give them 60 days notice to find other infrastructure. Stripe is taking its OWN FAILURE to properly vet their customers according to their own standards and dumping the consequences onto the ex-customers. Sorry, but unless we're talking actual provable international criminal/autocratic money-laundering, that's just wrong.

The part where they said everything was fine and then re-locked so much a week later is completely unacceptable even if the business does violate the TOS.

Is it all companies that can no longer decide who they do business with in accordance with the terms of the contracts in place?

https://www.paypal.com/us/legalhub/acceptableuse-full

always read the fine print

> PayPal and Stripe don't advertise that they will only do business with organizations with which they agree.

Huh? Of course they do. Just one example:

https://www.paypal.com/us/smarthelp/article/what-is-paypal%E...

> PayPal and Stripe don't advertise that they will only do business with organizations with which they agree.

https://stripe.com/legal/restricted-businesses

> Firearms, explosives and dangerous materials

> Guns, gunpowders, ammunitions, weapons, fireworks and other explosives. Peptides, research chemicals, and other toxic, flammable and radioactive materials

Why does the payment processor get to dictate whether I can run a defense ordnance company or run a scientific chemical supplies store?

Some of this stuff needs to be challenged in the court or regulated so that payment processor has no say whatsoever in whatever their belief system says about legitimacy of a business.

> Why does the fucking payment processor get to dictate whether I can run a defense ordnance company or run a scientific chemical supplies store?

Because they have the legal right to do so? They could ban companies run by redheads, if they like. As long as they're not discriminating based on very specific sets of criteria established by law, they get to choose who they do business with.

The government requiring private citizenry to associate with everyone who wishes to associate with them seems like a very dark path to go down.

While I agree with your point, I think banning redheads would violate Title II of the Civil Rights Act of 1964.

No; hair color is not what that legislation covers.

It is entirely legal in the United States to discriminate against redheads, or people whose names start with B, or Hacker News users, or people who enjoy skiing.

https://www.fwlaw.com/insights/is-hair-a-protected-class#:~:....

If you read that closely, it doesn't apply in the slightest to the example.

I do believe that there could be an argument that discrimination on hair color could fall under national origin or color:

Under 29 CFR § 1606.1, national origin is defined as but not limited to: An individual's, or his or her ancestor's, place of origin; or because an individual has the physical, cultural or linguistic characteristics of a national origin group.

With the current court, almost certainly not; they're not inclined to expand the definition of "disparate impact" like that.

If a future Court ever decides hair color denotes national origin, fall back to a different example of your choosing; people with tattoos, Mac users, viola players.

Hair color is something you're born with and is a genetic mutation based off lineage and other factors. I don't think they directly corelate and it wouldn't necessarily even make it to the Supreme Court. Most businesses aren't going to appeal to say that they can discriminate based on hair color nor willingly admit to doing so, nor would they ever likely make the argument that they did it and that it is okay.

The law doesn’t say “things you are born with”, though. That’s a common theme with the specific categories it does name, but only those specific categories are protected.

It isn't specifically limited to those specific narrow words by the most limited means you're thinking. I'm sure they could make that argument, but only a fool would risk a discrimination lawsuit based on hair color. Even if that is the specific reason a person would have to be either a fool or want to try to challenge the law, and there is no guarantee after losing that the Supreme Court would even take the case. I don't think the Supreme Court would even want to touch such a case nor that it would be ruled on in the manner you're thinking.

You could discriminate against people with dyed hair colors, but I find it hard to believe that any court would say that a person's natural hair is not a physical characteristic of a national origin group.

They are common carriers. The elephant in the room is the Visa/Mastercard duopoly.

As a red head, this made me chuckle. Thank you.

Why do you believe that private companies shouldn't have freedom of association? Or put differently, why should the government be able to force Stripe to do business with people who Stripe thinks would not be good for their business?

In a world of free association Stripe would probably be more willing to do business with "high risk" companies because they could charge them substantially higher fees. The government directly and indirectly tries to discourage business with these kinds of companies which is why companies like porn websites, fireworks wholesalers and check cashers have a hard time getting bank accounts these days.

Sorry, who do you believe is preventing Stripe from charging higher fees to riskier accounts? Please be specific.

Also, what's your evidence that some payment processors don't handle porn because of government pressure, rather than just natural market forces? I had a friend who did tech for a porn company, and from what he says, even a well-run porn company has much higher rates of chargebacks (e.g., next-day regrets and "no honey I don't know what that charge is") and fraud (stolen cards, fraudulent affiliate program participants).

You mean the belief system of wanting to not get sued by someone who get's hurt or killed?

I was considering starting a weapons ordnance company, getting federal ATF license and bid on a contract to USG and NATO forces. I guess Stripe billing isn't going to be our choice of service. Stripe has really good invoice/PO processing APIs.

On the off chance there are more regulatory requirements to accept this sort of business and they don't want to build out the support necessary to do so? Maybe there's different risk profiles that they're not willing to accept

Stripe has an internal list of "instant ban, no questions allowed" activities/triggers.

Think about how they can accept 100+ currencies without a relationship with some dodgy central banks in developing countries.

There are absolutely items on that list for political reasons.

>Does it matter?

That is indeed the question. There is no way of knowing if the nature of the business is a factor unless you know that nature of the business.

This is more a function of the fact that I don't want my business to be identifiable from this post than that it's a sketchy business. You'll have to take my word for it, but it's exceedingly benign.

Are you sure it's not a medium risk business that IS benign, but STILL is considered medium to high risk?

For example, selling video game digital products like a strategy guide is benign, but gaming industry is ripe with fraud so most processors will give you shit if you're in the gaming niche, let alone (non-crypto) digital currencies, crypto, health products, non-snakeoil supplements, etc.

Even if this is the case, it doesn't mean that Stripe should just be able to turn off a 3rd of the guy's business with no warning or reason. If they don't like what he's doing, tell him and give him notice to switch to another provider rather than just tanking his business over night.

Yeah that isn't how payment processors work. If his clients are in breach of Stripes TOS it puts Stripe at odds with the compliance teams at Visa/MC/Amex immediately if they are processing his payments.

Source: I used to run adult websites which is considered 'high risk' and also these days responsible for overseeing 1M/m in CC processing for a state agency.

They only reason theyd do this is for reputation. They don't want a good reputation with people in risky business.

I believe you, but I was also triggered by this line here

> They know exactly who our customers are and what services we offer, and have approved it as such.

which sounds like you offer services out of the ordinary.

Which is besides the point.

It is not. A company like Stripe is free to decide it does not want to be associated with certain services. You may disagree with that, and I would certainly agree they should at least be upfront about it, but it is not beside the point.

It certainly sounds like it’s some sort of e-pimp business based on what we know so far.

Source for that? OP is usign a throwaway account and hasn’t said anything about the business.

That's most of it; having clients that have their own sub-stripe accounts that are triggering fraud detection and not mentioning the business.

It's not much to go on but it's all we have.

It is free to do that, but if it decides it wants to kick customers out immediately without explanation, we are free to tell one another and use a different provider. That is the point we're discussing, whether the dev community can still consider Stripe reliable and professional.

Since HN is a community, you might have more luck getting this fixed if you posted this with your regular username? Never mind this suggestion if you have previously posted "sketchy" opinions that would harm your business, although you may be past that point now...

Agree. The OP account was created today. If it was a long-standing user with lots of comment history, then I’d be more inclined to wonder what was going on etc.

Creating a new account on here to potentially get support is just plain wrong, and needs dealing with IMO. Should never hit the front page.

The problem is that my real HN account is my actual name. It'd be like 2 clicks to figure out what my business is.

Yeah, me too. I was wrong to suspect that you wanted to avoid associating your business with your HN content. So, are you trying to avoid leaving an online record of "this business helped Stripe screw over its customers"? Unless your customers have strong incentives not to talk publicly about their experiences, that ship has sailed...

Ha, not quite. It's more I'm concerned that people considering using my product will see this in the future (hopefully when this issue is resolved) and be wary of doing business with us.

Is it an animal, a mineral, or a vegetable? Surely you can give us enough generic information that we can know roughly what kind of business you run without making it searchable.

We operate in the public sector where the number of startups is small. If I shared the vertical you'd be able to narrow it down to 2 or 3 companies.

Totally understandable, but what kind of business is it? If you just keep saying 'it's a business' but refuse to provide any further details then people are gonna make assumptions, eg adult entertainment. Nobody's asking what your specific business model is.

Also consider that if the situation continues your pissed-off downstream customers will ID you sooner or later.

He's ignoring the "what type of business" questions. I'm getting downvoted. I don't care. He's ignoring it for a reason still.

We operate in the public sector.

Assuming it's legal, should it matter?

Yes, it matters deeply, because some product categories are so rife with fraud (or are positioned so prominently in the fraud value chain, from carders to cashers) that they can't be served cost-effectively by conventional payment processors.

That still does not excuse the total information blackout.

I don't know what that statement has to do with my comment or the comment I replied to.

The post does note that Stripe has been supporting this business and these customers for years.

If for some reason Stripe wants to withdraw that support, they must give their reasons and a proper period for transition to another provider.

you're implying the business is illegal or violates TOS?

if it's egregious, I'm assuming someone from stripe could get in here and ask permission from the OP to explain to the community what happened?

The overwhelming majority of stories I hear about paypal fucking over businesses are about benign transactions.

I don't think your judgmental paranoia is founded.

I would agree with you, cwkoss, except for this:

https://www.reddit.com/r/paypal/

and

https://www.trustpilot.com/review/paypal.us

and

https://www.bloomberg.com/news/articles/2022-06-03/paypal-cu.... (which was attempted as a class action lawsuit)

Are these supposed to be evidence that paypal doesn't fuck over businesses engaging in benign transactions? Because just seems to be evidence that paypal fucks a lot of businesses over.

FWIW, there was a story about this sort of issue on national radio (in the US) a few weeks ago. The gist of it was "I can't rely on Stripe for my payment system because they vanish too much for too long."

The businesses were very not shady, and nowhere near morally controversial.

My impression from that piece and these stories is that Stripe is having some technical problems and it's wreaking havoc everywhere.

I'd be curious to listen to this if you have a link?

I was trying to find it but can't... I thought it was on Planet Money but might not have been. I'm pretty sure it was a program on NPR because that and college radio are about all I listen to on the radio, and it wasn't a podcast.

I wish I could remember the details better. They were focused on small business owners, retail mostly. I think they started out with an interview of someone with an interior design-related business.

Even if there's a legit reason for this, the lack of support bandwidth to resolve it is a key platform governance issue. Like if there's nobody on the other end of the fax machine, at scale, that's bad for everyone who touches the stripe ecosystem.

Inability to explain it is infuriating. Absent an explanation, everyone's default assumption should be that they did it randomly, by mistake, or maliciously, and that they're liable for damages. If S is being told by law enforcement to do this, fine, I get it, but at least do an EOY report like everyone else saying '90% of our unexplained holds were court orders, stop blaming us and help us reform this'.

'Governance through obscurity' isn't going to be any better than security through obscurity

So, this is another "drive by" on Hacker News about Stripe, which @edwinwee (from Stripe) reacts to and "saves the day".

All the while the rest of us know absolutely nothing about what just happened!

What exactly is going on? What is the business model? And why does it require that these cases reach Hacker News before they are solved by @edwinwee!?

I can't proactively share specifics about a business, but in this case, they operate in a regulated space. The banks and card networks we work with require some extra checks due to the prevalance of scams in this space. A reviewer on our team flagged the business, and admittedly, we weren't very clear about what was required in order to continue working with us. After talking with OP today, we re-enabled the business.

1. Tomorrow we're regrouping with the team to see how we can improve our processes to prevent a similar case from happening again.

2. We're working on a new version of the Stripe Connect dashboard right now. There will be much more detail on which connected accounts are restricted and how to resolve the issues. We want to release it soon and I think it’ll provide platforms better visibility into the state of their accounts.

Thank you for clarifying.

I feel that HN needs some kind of "right to reply" feature on these stories now - something like a pinned comment right at the top of the discussion for an official response from the business in question.

It is obviously of interest to many in the community if services they might use or consider using themselves are having problems or letting their customers down. I personally have no problem with leveraging the publicity that social media affords to get a problem resolved if those services haven't got their act together within a reasonable amount of time.

However there is a serious risk of unfair or just plain incorrect reporting when one side gets to set the agenda and the other side either can't respond for legal/regulatory reasons or has their response buried among the other comments. People can be far too quick to reach for the pitchforks in these discussions before knowing all the facts and on sites with voting mechanics there is a danger of mob mentality distorting the subsequent discussion as well.

In this case it looks like Stripe probably did handle some aspects of this situation poorly (bad and people deserve to know it can happen) but are probably also taking steps to avoid screwing up the same way in future (good and people deserve to know that too). Then everyone can form their own opinions and discuss the issues but at least starting from a relatively balanced and well-informed position.

To be fair here, I believe that most people on HN are fans of Stripe (I'll admit that I am) and this isn't going to cause me to write them out of anything. BUT nothing is worse that feeling ignored and we all can empathize with that. Stripe's promise to us in tech was that they were/are different. Patio11 has written some great articles from inside Stripe explaining how the payment systems work. PC and JC show up at conferences and chat with other devs. This is inherently different that what you can expect from the CEO of Paypal or Authorize.net.

Now we're asking that to stay true to that part of the company. Not because we want to see them fail but because we want to see them succeed.

That's exactly how I feel. Couldn't have found better words.

Hey Edwinwee I can appreciate that you're the guy who always has to stand in front of the HN mob, but the answer you gave here is terrifying because it makes it seem like people in Stripe are acting without any empathy for customers.

For example, OP says they've been reaching out to Stripe and couldn't really get any answers but but somehow you were able to get all of this cleared up within the day.

I get that a "regulated space" complicates things, but why was the client cleared last week and what changed? Why last time was it only shutting down a single client and this time 35% of clients? Is this done on a customer by customer basis or are there other stories out there of customers who were/are affected today by the same issue?

Lastly, when someone (a reviewer?) at Stripe shuts down an account do they notate why the account was shut down and if so, is there a reason this isn't shared (at least with frontline support)?

>somehow you were able to get all of this cleared up within the day

Exactly. This is why the whole "their hands are tied" excuse is so frustrating to me.

>After talking with OP today, we re-enabled the business.

Why didn't your team respond to him earlier?

This problem is endemic in Stripe. I wanted to enable issuing on my account to test card issuing, but there was a bug where the ui was looping, not allowing me to sign up.

Asked support, got 2 weeks of "we're working on it"'... And finally a "You're using Opal, you can't enable issuing".

They're losing thread fast.

Just a reminder while this may seem like a Good vs. Evil clash between OP and Stripe we will never have all the facts. OP does not enumerate their business model or go into details about their customers and transactions. Stripe absolutely should not share internal customer information.

While we may see Stripe chime in the thread, and make summary judgements, we will almost surely not have total visibility (and thus closure) in this case.

True, yet not an excuse for lack of communication with a long term customer.

> Stripe absolutely should not share internal customer information

Not even with that customer?

That's a really dumb take.

It's easy to forget the firehose of fraud attempts that platforms like Stripe, PayPal, etc must be dealing with 24 hours a day. I assume that's what's behind most of these unfortunate incidents. Not that there is fraud in this case, but this could be one false positive among billions of true positives.

Sure, but the government should legislate that companies be given a reason and not stonewall customers. The absurdity of allowing companies to giga-scale and not have real customer service is just dumb and bad for society

Three things become clear once again. We need laws making it illegal to fail to provide a detailed reason for serious actions like this. We also need a complete reworking of the system as it is.. and likely a new official means for payment transaction services in general. Finally, and particularly in the context of digital money, we need laws ensuring bank/CC/PP neutrality. Just like water, gas and power. Financial services are just as fundamental and vital. If we can underwrite, back up, protect and bail them out, then they shouldn't be able to pick and choose or play favorites.

Additionally, almost forgot to add. We need the government to stop treating financial institutions like they are law enforcement. I can't think of any other field, product or service where private or even semi-private actors are expected to actively play a roll in fighting crime, with actual legal stakes if they fail or don't play along.

Pharmacies and prescribers are required to play an active role if they want to be licensed to dispense controlled substances.

I still want to see Congress pass a law requiring any internet company that accepts money or fees from you that bans you, must give the exact reason, evidence, and where on your contract / ToS you violated. Frankly, at a certain size (millions of customers), these companies are utilities.

Banks are regulated to death but I see that on the whole as a good thing. These payment processors need the same burden. They’ve shown that they won’t play fairly without intervention and market forces aren’t fixing the problem.

Current Anti Money Laundering regulations actually require the exact opposite! If a financial company's customer is under review for fraud or money laundering, it is illegal for that company to let their user know.

I’d probably use Stripe first if I built another FinTech. But it’s important to know that it’s viable to build your own ACH integration too. It took about a month of my engineering time to wire this all up for my last startup. (Not including contract time from the business side).

As a backup plan I’d suggest talking to a bank like SVB to see if you can set that up. (It’s always nice to have a warm standby payment rail if your business depends on it, though it’s really annoying to set up fully.)

For context the SVB integration is sending a NACHA file over sftp, you could do this manually for a single batch using the Python ACH library in an afternoon.

Yes, now you need to hold account/routing info, and collect PII like SSN/TIN. This makes infosec more expensive. But not as bad an option as going out of business.

On the plus side you can turn around debits much faster, use same-day ACH, and pay a few cents per transaction.

(If you need help on scoping/implementing this I happen to be available for consulting right now.)

This is why we need a decentralized Internet payment system, like email.

This was a non-controversial opinion not long ago.

Your sentence caught me off guard, maybe I am reading it wrong. Do you mean email as a payment system, or do you mean email as an example of a decentralized system?

The latter - a system that is like e-mail (decentralized) but allows people to send money to each other.

We have many such systems being developed, but you get downvoted on HN for promoting them, since people assume you are a scammer, a criminal, etc.

Ironically, email is becoming increasingly centralized. See this story from just a few days go

https://news.ycombinator.com/item?id=32715437

Yes, as with any protocol email is always subject to centralizing forces. But protocols like email (to me) represent the best possible approach to trying to counteract these forces for Internet applications. They aren’t a silver bullet but maintain the best forms of optionality for undermining and correcting them.

How can they still be in development when the underlying tech has been available for 12 years or so?

In the real world, there is no anonymous e-money that doesn't end up having to be laundered back into good old cash.

Lol yeah so you are talking about a cryptocurrency but actually afraid to use that word. I know, I just did in my other comment and I know I will be attacked here.

If gmail/outlook/yahoo bans you or mark you as spam, you are not gonna get much done.

Yes the maximally centralized form of a protocol like email is the one we have now where a few large actors can collude to cut you off from large swaths of the network.

However, that’s different than a singular actor, but more importantly, nothing is stopping a counterforce from coming in and correcting that regime. It’s possible we may see email revert to a less centralized form over time as various people choose to prioritize working that problem (and can make headway, because of how email works.)

The point is email as a protocol is extremely open, but email as a network is quite centralized. There aren’t any great options here because buildings a system is easy but interfacing it with the real world and all it’s laws and bad actors is hard.

What people forget is interfacing with systems designed to operate in the real world is at best an abstraction over this difficulty and eventually it gets exposed for the mess it actually is.

This is unlikely the spam problem is too hard to solve at the small scale for you to ever be relevant.

We should, but the problem is consumers want the protections offered by PayPal and VISA who do fraud analysis and can clawback money etc. etc..

There's definitely a space for 'digital cash', for sure, but consumers will prefer the former.

When it comes to money, there are just deeply inherent issues of dealing with fraud, spam, goods not delivered etc. etc.. which adds significant overhead to the whole system.

Most people playing above-above board don't have a problem.

Usually in these cases, it's because something semi-shady is being sold, and it usually contravenes one of the T&Cs of Stripe.

The OP here didn't tell us what line of business they were in.

Yes, of course this is a huge challenge. That’s the point tho, the high order bit is we should want to solve these problems and support good faith actors who are actually trying to.

What problems? There are organizations that are not Stripe where they have much better support.

A payment system like that would run face first into Know Your Customer (KYC) laws and bet shut down.

This isn't a hard problem for technical reasons, it's all political. It's about preventing money laundering and trying to fight crime via financial instruments. But it also means any payment system that doesn't implement these restrictions will almost instantly be overrun by criminals because they are highly motivated to find ways of moving money.

A payment system like that would run face first into Know Your Customer (KYC) laws and bet shut down.

Great, then let's change those laws.

Good luck, not going to happen.

Democratic systems won't change these laws because there is no popular support for change - there is a reasonably large 'law-and-order' and 'corruption-as-main-concern' voter demographic who strongly support these laws, and the niche of HN techies and libertarians who'd oppose them is insignificantly small in comparison; and authoritarian systems won't change these laws because their leadership supports them even more.

I acknowledge that that is the prevailing sentiment, and the obviously correct conclusion. And yet I can't accept that kind of defeatist thinking. To embrace defeatism on that level is to basically accept that nothing will ever change, and we know that things do, occasionally, change. It's not always clear exactly what it takes to create wide-scale societal change, and yes one could easily spend their whole life engaging in activism and die with nothing to show for it. Yet people do still persist, for their own reasons. And sometimes the good guys do win.

It's not passive giving up - many people, including me, consider the social change you want to drive as harmful in aggregate, and would fight against it; and I'm asserting that at the moment we are in the majority.

I understand the idealistic benefits of freedom of payments, however, the KYC/AML restrictions are there for valid reasons that simply have much more magnitude of importance (for example, the scale of corruption and its social harm is so big that even a slight decrease in that due to KYC/AML enforcement far outweighs all the current social costs of KYC/AML) and removing them would mean that in aggregate the bad guys have won. I'm not saying that you're a bad guy, but you are an "ally of convenience" to them as achieving your position would let the bad guys win and I would consider it immoral to allow that.

We definitely should strive for better, more accurate AML/KYC implementations that have less impact on legitimate trade. But arguing for removing AML/KYC just because of that is effectively throwing out the baby with the bathwater.

Fair enough.

The most compelling reason to argue against these kinds of laws is to think of their full consequences if suddenly illegal transactions were virtuous, as they have been in the past when totalitarian regimes have gained power. The present day doesn’t put a high value on freedom to transact in the west, because most illegal transactions in the west are for things many would consider criminal or immoral. But if times change (as they do in history) then not securing the freedom to transact and a vibrant economy rooted in this freedom will be come to seen as a grave error imo.

Why? They are a net benefit to society and above board businesses.

Why?

If you subscribe to the belief that criminal activity is a drain on society then there is a case for trying to combat it. Then it becomes a question of "do these KYC laws cost more to society than the crimes they prevent?" That is a harder question, but it is hard to overstate the amount of damage to a society rampant corruption and crime can cause and the benefits of allowing anonymous finance are somewhat more nebulous.

I wonder if criminals didn't have so much money to launder, would bitcoin have ever managed to jump the "belief gap" to the extreme degee it did, from computational bits of cryptographically unique data into actual spendable dollars?

Isn't that what cryptocurrency is?

One option may be to investigate migrating rather than continuing to wait on Stripe's lack of customer service. When I was investigating Stripe Connect alternatives I found Square to be a good option. It was easy to migrate our billing code over and it acts essentially the same. The only key difference is the end user would access their own Square dashboard and manage their funds, rather than it all being managed by you.

That sounds a lot like the stories I heard about Paypal, and their fraud detection team. There was an article interviewing someone about it. Back in the day, Paypal had to build tools to detect fraud because no one else was doing it at scale, at the time. I recall something about investigators outside of Paypal started to use those tools as well. I would not be surprised if Stripe had to create similar tools for themselves as well. Without transparency, it's hard to say what the false positive rates are, or what has changed in internal processes or in the regulatory landscape that might have triggered something different.

Stripe abstracts away a lot of the complexities involved in the payment and banking world, but there's a ton of infrastructure there related to detecting fraud and money laundering. Unfortunately, the lack of transparency makes what might be a leaky abstraction look like a Kafkaesque bureaucratic nightmare.

Back in the day, Paypal had to build tools to detect fraud because no one else was doing it at scale, at the time. I recall something about investigators outside of Paypal started to use those tools as well

Palantir came out of Paypal fraud detection

https://thehustle.co/%F0%9F%92%B3-how-paypal-fraud-made-pala...

Any time now Edwin or someone else from Stripe who gets pinged when a story hits HN frontage will come in here and post some copy paste “pLeASe eMaiL me”-apology and then everyone can feel good about themselves again. But in the end nothing changes.

I will take the OP's story at face value, but I think a common theme in these sort of posts is the "Stripe not happy with my business model" angle which typically does not actually include any details about the business model.

For example, a few weeks ago the founder of Tailwind tweeted [0] about how Stripe had shut down their account when they were set to launch the Tailwind Job Board, despite many other job boards also using Stripe and there being no obvious increased risk. Any rational person would protest the fact that Stripe does not approve of this business.

Compare that to what I've seen on various Facebook groups about Stripe shutting down accounts. People aren't descriptive about what exactly they're selling and it usually boils down to "coaching" or some other gray area.

[0] https://twitter.com/adamwathan/status/1550092016242946049

Stripe reactivated the Tailwind account the same day, which means something at Stripe was broken in that case.

How is "coaching" an obvious gray area?

When I bought the All-Access pass from Tailwind Labs last night it went through Paddle.

Looks like this erroneous holds/deactivations are costing Stripe real business.

No, it means the case got enough attention on social media.

Just like here. We have those "Stripe shut me down" posts on HN regularly.

Oh look! 49 days ago: https://news.ycombinator.com/item?id=32263421

I'd imagine many "coaches" promise the world and deliver very little. They likely have very high chargebacks / returns / disputes that Stripe would rather not deal with.

There's no real product so they're easy to spin up and run a bunch of stolen CC numbers through.

ETA: Either the site all together or as an individual coach on the platform.

I'd wager if Adam didn't have over 100k followers on Twitter, and wasn't a big deal in the web development community (most have heard of either him, or at least TailwindCSS), he'd get the same treatment as the OP, which is "you did one or more things wrong that's listed on this huge page of conditions, go figure it out."

> Any rational person could see the issue with Stripe not approving of that business.

I think of myself as a fairly rational person, and I don't see the issue. Would you mind spelling out whatever you're trying to imply?

my thoughts exactly

The comment was phrased poorly and is difficult to parse. Better worded, same meaning: any rational person would protest the fact that Stripe does not approve of this business.

It sounded OK in my head :-)

I think they're saying Stripe thinks those businesses are scams, illegal, or otherwise in gray areas that Stripe would rather not support. There's probably some automated decision-making happening on the backend so there are edge cases where good business are getting shut down on accident.

If that is the case, that is fine.

Then Stripe can FORKING SAY SO UP FRONT.

And those businesses can grumble but go elsewhere

Implying that you are happy to take on responsibility for infrastructure of someone's business, then unilaterally and without notice or opportunity to cure any issue, is pretty much tantamount to theft. Stripe in this case appears to be accepting money, then failing to provide service, and in this case is even holding onto money paid to their customers. This causes a lot more damage to others than it does to Stripe.

I don't like externalizing problems to other parties as a business model.

> I don't like externalizing problems to other parties as a business model

You just described the entire gig economy

YES! I have no idea why you are being downvoted on that - while it wasn't in mind while I wrote it, it does indeed apply! All the problems are at placed on the gig worker and the Ubers/AirBnBs/Instacarts of the world provide the software and work to shed as much responsibility as possible onto the drivers/hosts/workers. Apparently, there's a fair number of ppl on here who either do not see that or whose salary depends on them not seeing it.

I think the author refers to "Stripe not approving the business" as an issue.

A Job Board not being approved, despite many other job boards also using Stripe and there being no obvious increased risk.

maybe I'm not a rational person but could you explain why they would not approve of that business?

> Any rational person could see the issue with Stripe not approving of that business.

I guess I'm not rational. What's the issue with running a job board and charging for posts through Stripe?

What is wrong with a job board or a coaching business?

Nothing is wrong.

The risk profiles are different. That is only thing the payment processor cares about, same reason why adult services get shunned. Not because they are puritans, it is because of risk of frauds and chargebacks etc are much higher .

Coaching is a service unlike Tailwind the software that can varying success and satisfaction levels customers probably do higher chargebacks and stripe's automated systems or low level staff with a playbook likely rejected it until someone senior got to see the bad press and got it fixed.

Why would this be such a difficult thing to communicate to a customer?

"Hi, we've noticed an increase of frauds/chargebacks on your account so we have taken X action"

That also doesn't really explain why long-standing, established customer accounts were frozen with this particular business.

Unless you get a decision overridden by Edwin your pretty much stuck using an alternate payment process. I have been thankful Edwin was available here on HN, and Stripe definitely has a much more reliable product than competitors.

Who’s Edwin? Is that the username here? I’m having the same issue. Was hoping to resolve this using customer service rather than through social media. But I just can’t seem to talk to any real human at Stripe.

What issue are you seeing? Could you email me at edwin@stripe.com?

Thanks Edwin for reaching out. I’m on mobile right now, but I’ll email you tomorrow.

It'd be great if companies' support processes worked well, and there was no need to reach out to specific individuals on HN, etc, but ... those individuals, like Edwin, who end up being "the Stripe guy" on HN do such amazing value-add for their business.

It's incredible to me that despite the sheer size of these companies, and the enormous number of customers from all over the world, that there's a place you can go and get someone who will pay personal attention to your issue.

Kudos Edwin.

See this comment: https://news.ycombinator.com/item?id=32854831

Email Edwin and also reply to their comment on HN conveying the high level summary of what you think is going on with your account.

Normal Stripe support reps seem to stick to the script no matter what. Edwin has fixed edge cases for HN users in the past thankfully.

There's actually a response from Patrick Collison in that thread that may shed some light on OP's case.

https://twitter.com/patrickc/status/1550136569482252289

""What is happening?" => basically, a major uptick in attempted fraud over the first half of this year that necessitated making our systems stricter. But have an idea for a structural fix here. More soon. (DM me if you've had problems on this front.)"

The DM part may only apply to the high profile person he's responding to. :-)

Making your systems stricter will have the obvious side effect of increasing false negatives. Not scaling support, or fixing what is clearly a fundamentally broken support system, is incompetent.

Exactly. Especially when your decision is hitting a business right where it hurts: Cutting off revenue and invalidating customer-facing payment links.

How can any founder rely on Stripe, much less recommend the platform, if you need to have a backup system in place “just in case”.

> Any rational person could see the issue with Stripe not approving of that business.

Genuinely can't tell what you're suggesting the business model problem is with Tailwind Jobs?

According to the CEO at Stripe, the issue with the Tailwind example you listed was "a major uptick in attempted fraud over the first half of this year that necessitated making our systems stricter. But have an idea for a structural fix here. More soon." And then Tailwind Jobs was reactivated.

> Genuinely can't tell what you're suggesting the business model problem is with Tailwind Jobs?

They're saying the opposite. Paraphrased, "any rational person could see that Tailwind Jobs is a legit business and that it's wrong for Stripe to shut them down".

"The issue" in the sentence you quoted is referring to Stripe's behavior, not Tailwind Job's business model.

Yes, they almost always fail to mention it. Then it turns out they’re selling cannabis to Iran or something. And (rightly so) payment processors can’t tell us what the problem is. So I’m inclined to flag all such stories missing the obviously key information.

"rightly so"

What possible benefit could there be to anyone in "golly gee, who could possibly know?" vs. "It's because you're selling cannabis to Iran, stupid"?

My guess is that it's because most people aren't selling cannabis to Iran, and the Real Problem is the liability they [Stripe, et al] would be exposed to if they admitted their billion-dollar system (and/or call center employees) can't distinguish between Cuba and a cubano.

This really sounds like you're biased since your YC affiliation means you're invested in Stripe, and your statement essentially reads as "the (YC company) is always right, and the customer must prove otherwise." This mentality is largely the reason people hate tech/SV in the first place.

I'm not making that claim. I'm pointing out that a customer saying "X locked my account" without the relevant information for HN readers to decide whether or not X acted improperly doesn't make for a good HN submission.

If this company sells T-shirts or something, then Stripe may have acted improperly. If they sell cannabis, then Stripe would have acted as the law requires, as everyone in that industry knows perfectly well. So it's pretty relevant information, and HN readers deserve to have the information they need to make informed decisions. There are plenty of other places online for uninformed outrage bait.

> There are plenty of other places online for uninformed outrage bait.

There aren't though. People come to HN to complain about getting fucked over by YC companies because it's basically the only place people will get a response. I'm not saying all, or even most, complaints are valid. But your immediately siding with the YC company just shows your bias, which is expected since you're literally invested in the company.

Regardless of whether or not Stripe is legally in the right, their customer support is absolutely abysmal. And the problem is that this is clearly a trend with YC companies and the fact that people have to vent about it on HN so frequently, and with such fanfare, says a lot.

I also noticed the suspiciously absent description of OP's business model. That said, though Stripe has never wronged my business, our dependence on them is such a large liability that it obviously has to be treated as such in our business planning. Our integration with Stripe is kept light and somewhat abstract, and we're able to replace it without putting a ton of work into overhauling our billing system. Naturally, this rules out the full use of Stripe's offerings, but the risk/reward trade-off is overwhelmingly in favor of a light integration. I would strongly advise a similar approach for anyone else integrating with any payment processor.

Side note: the cryptocurrency shills in this thread are pathetic.

My first thought is this is a paycam business of some kind, or something very similar.

Thank you for sharing this. This is definitely among our marketplace existential threat as well. We have a few Stripe Connect clients account that got shutdown with zero visibility for us the platform account.

I am wondering if anyone has experience with exploring alternatives other than Stripe Connect. Our use case involves multiple payouts: buyer -> seller -> [us and referral person]. Especially if you involve multiple payment providers, how do you go about handling vault and card data. Stripe Connect and PayPal separately have their own vault features. Would it be annoying for the buyer to have to re-enter payment information several times to save cards on file.

Sounds like it may be time for some legislation requiring payment processors and other service providers (eg hosting/email) to provide an escalation process - probably human review - in cases such as these.

Although I agree that there are a lot of TOS violators out there, there are also legitimate businesses suffering real and tangible harm from these actions.

This case in particular sounds interesting. They were reviewed and the problem was fixed, and they were then again given the big ban hammer. In this case, I suspect the liability must shift to the provider for causing harm through failed processes/systems under their control.

Just my 2c

These are essentially utilities in today's world.

And with that you cannot turn off someone's electricity (which they don't "need": see Amish) just because you don't like them. And definitely not while hiding behind an algorithm.

As you are, I'd focus on my business first. How do you get Stripe out of the equation? Stripe exists, in part, because of how bad the incumbents were, and could never innovate. But now that they have competition, could you switch?

I mean I love supporting startups, and YC, but Stripe has a $100b or whatever valuation... They'll be cool.

What is the business model? There’s a lot of detail here for that to be given a passing mention.

Is there a common theme between these posts?

Huge warning signal to not use Stripe if this is their level of support for large business. If you're this large how do you not have one guy right accessible through a direct phone call? Stripe's slipping.

I was recently banned from Paypal for life, with no reason given. I have literally used PayPal for over a decade, usually once or twice a year to pay family or friends back from something small. I have heard all the horror stories so I intentionally didn't use for anything unless the recipient had no other easy way to receive funds. I never used to pay for anything shady, or even buy anything really. It was almost always to pay someone back for dinner or something small like that.

And then one day last month I got an email saying my account had been banned. They would not give me a reason, and told me if I tried to open a new account it would be banned as well. Good riddance, I don't need them anyway, but talk about burning any vestige of good will they ever had.

It seems Stripe has gone the same way now. Time to move on to the next hot payments processing startup until they get big enough that they decide to start fucking their customers too.

I work for a company that helps a lot of PayPal refugees. We hear these stories all the time. In many cases people know exactly why they were banned, but it's amazing how often they have no clue (like OP). Apparently these mystery bans tend to originate from automated systems, and there are too many automated bans for it human agents to be able to investigate them all.

While it feels like rule of the machines, it's actually rule of the fraudsters. If these payment processing platforms weren't so broadly vulnerable to fraud, they wouldn't need to rely on machines to make these critical decisions. An we can blame the credit card and ACH systems for both heavily prioritizing convenience over security via "pull" payments. Yes, crypto offers "push" payments, but those actually increase the risk of fraud for buyers. I think the killer combo is crypto with escrow, to protect buyers. But of course escrow has higher costs than just blindly transferring funds like the payment processors do. That's why this is one of those perennial problems of commerce.

We've got to learn that this is an inevitable consequence of our appetite for automation and scale.

If your business is important enough that it can't risk falling into the endless hellpit of automated, anonymous, hyperscaled infrastructure, then don't build your business on automated, anonymous, hyperscaled infrastructure.

I wonder how much you’re being caught by protections set up against bad actors.

Bad actors have massive incentive to try all sorts of insanely advance schemes to ensure their cash flow (I saw this both at MP3.com and Zynga early days). As a company, Stripe has massive incentive to stop them. If you stop 95% of bad actors and cause .01% of good actors to get caught up in the enforcement, that’s a net win for the company. If I was running Stripe, you’d be an acceptable casualty.

Of course to you, you’re not an acceptable casualty and this is a shitty situation. The advice in this thread about having multiple processors you can switch between is a technical and financial headache for you to implement, but it’s really your best bet.

I’m sorry you’re going through this, I hope it works out, but the tough love call here is you are an acceptable casualty and need to plan accordingly.

All of this is voodoo. I just moved and the airline that services the main airport is not one I normally fly with. Okay, good airline, lets apply for their credit card to get miles, status, etc. Fill out the application online. Expect answer quickly. No. 5 days later turned down. We will send you a letter explaining why. Still waiting. I am CEO of a startup and have a FICO of 832 out of 850. IE perfect credit. Card is backed by BOA. Voodoo.

I am very much in favor of making the laws simple for payment providers as it is the best way for everyone to grow and succeed. That being said the laws for financial institutions need to require someone to talk to, a time limit on response time and an escalation process to resolve issues. We shoot ourselves in the foot here by not mandating clear, clean procedures for dealing with issues.

This is exactly what has happened with my Shopify account. All of sudden, they cut off the account and held the money hostage. This was a month ago and they have yet to give me a reason why. I get one email a week from them, and I have responded to each email with all of the information requested. It's really frustrating. I am not doing anything fraudulent... but I must have triggered something in their system. They had no problems with completely shutting down not only my payments but also my website that I've put hundreds of hours into. I plan on reporting them to the BBB.. once I get my account activated and withdrawal the money. I hope you do the same with Stripe.

On a similar note, my 12 years old active account with payoneer has been blocked for a month and half now, same customer support, no explanation. There needs to be a law that at least forces them to resolve the issue in a timely manner.

This is one of the reasond I hope some form pf crypto payment system will succeed. We need to get rid of the middle mans(banks, payment processsors, credit card dopolies etc). It's time for a better payment system.

Some mentions that Stripe is having more and more bad press like these, but I do wonder if that's true.

Granted, horror stories just like OP's are not great, for Stripe and for those who use Stripe, but we tend to keep in mind the bad press more than the good.

With Stripe growing and having more and more business, it's just basic math that the number of bad press will grow along. OP's doesn't mention (maybe intentionally) what business he offers so maybe the team has a good reason to put 35% of their user on hold (granted, the communication around it isn't great).

We are in the process of moving off of Stripe Connect (with 60+ accounts) for this very reason. It's one big black box. They are a liability, not a service.

Very sorry to hear of your situation, but it's because of people sharing stories like this that we've been planning our migration away to a more responsible (and responsive) processor for awhile.

It's a ton of work to build new integrations, migrate data, and disrupt customers. Which tells you just how bad of an experience it is with Stripe when we'd rather spend a 6-8 months moving away.

Could you share the reasons you decided to move off it?

"it's because of people sharing stories like this that we've been planning our migration away to a more responsible (and responsive) processor"

When a client is processing millions of dollars per year, it's too risky to be in a situation where they have:

All authority in decisions No obligation of support

Either give me authority in transaction risk management to determine what's fraud or not.

Or answer the phone when I call to get support on what decisions have been made in my account.

They want their cake and eat it too. So I'll get pie somewhere else.

Where can we read your marketing copy? Where is the link to your website?

I can understand the need for anonymity. It wouldn't fill customers with confidence to Google the seller and find a giant thread about how his payments service cut off 35% of his customers.

Western payment processors have proven in recent years that they will cancel/unperson anyone who doesn't fit with their political ideology. This is not the first instance of it happening. And it may not be any actual wrongthink; it may merely be perceived wrongthink or programmatically determined wrongthink.

Because of this, I strongly recommend connecting to Asian payment processors. Even Chinese is more reliable than western these days.

Any specific recommendations?

https://ikajo.com/blog/the-most-popular-payment-methods-in-a...

> Western payment processors have proven in recent years that they will cancel/unperson anyone who doesn't fit with their political ideology.

Do you have any examples of this?

I wish there were better advise but after years of e-commerce experience all anyone will ever tell you is don't use Stripe. Don't use Square,don't use PayPal. Don't use any of the faceless companies for anything remotely critical and for anything that is critical have two backups. Basically that goes for things like hosting, payment processor or anything else your business depends on.

So what do you use instead?

Payment processors exist for customers who were rejected by Stripe/PayPal/etc.

I had a client who was a processor and they used banks in Malta at the back end.

A bank! All the banks offer merchant accounts and will have gateways they are setup with. Authorize.net is the big gateway if you want to do heavier coding and integration with existing solutions but there are hundreds of thousands of options. Regional banks usually offer the best rates. But this is if you are a "real" business. E-proccessors like Stripe, Square, PayPal etc are going after the very low hanging fruit of what are essentially consumers more so than businesses.

So drop the Stripe intermediation and just send your customers invoices as people have doing for dozens of years.

This person is using Stripe Connect, which means their customers are people who are paying them to charge other people through Stripe. So they can't just send invoices, they have to convince their customers to send invoices when (presumably) part of the service they were supposed to be providing was avoiding that.

So if someone else is handling billing for me, I should make sure they are not using Stripe Connect.

Honest question: what would be an example where I, as a business owner, would have some 3rd party billing my customers?

> currently, my product doesn't work for 35% of my customers. Cue torrent of pissed off customer emails.

Maybe fail open until you fix the payment processor issues? Seems it would be better to take the short term hit monetarily for long term gains and retain your customers than lose 1/3 of your user base.

Stripe has an office in San Francisco. I definitely don't recommend trying to go inside, but I really wish people would organize protests at these business locations. If hundreds of people protested outside stripe for canceling customers with zero communication, maybe the employees would notice.

While I typically support the "punk rock" approach, this isn't good to suggest. All it takes is one unstable person going cocoa puffs for someone to get hurt or something bad to happen.

Do you feel this way about all protests? Or just ones based around protecting people's incomes?

This isn't about protecting people's incomes, it's about bad customer service.

Just you saying that makes me say it's a bad idea because that framing in itself is emotionally charged which increases the odds that protest could turn into violence/physical intimidation. That's not terribly wise when there are alternative options for payment processors available.

It's pretty rare for "bad customer service" to cost people tens of thousands in lost revenue and pretty severe reputation loss for their business. I've had some bad customer service before, but it never set me back months or years of progress before.

So while I agree this is basically an issue of bad customer service, it is at the most egregious level. If your mortgage company started foreclosing on your home incorrectly, or the title company said "new phone who dis?" when you tried to sell your home, it wouldn't just be called "bad customer service". These are life altering issues. And these companies just don't care. A little public shaming of the people walking into work of a company like that could do some good.

> If your mortgage company started foreclosing on your home incorrectly, or the title company said "new phone who dis?" when you tried to sell your home [...]

Right, but that's a totally different situation and not one that would involve protest (it'd involve lawyers/lawsuits and court).

The problem with public shaming is the presumption that the people doing the shaming are in the absolute moral/ethical right (which is always subjective) and that anyone affiliated with the decided perpetrator (in this case, Stripe) are at fault. That's the problem with showing up at their office as an angry mob of people. An uninvolved worker could come out of the building and the mob could start shouting and attacking them even though they're a low-level employee who had zero involvement.

Doing it online is hypothetically better, but again, it just introduces a lot of unnecessary negative energy that is very unlikely to remedy the actual problem (and in extreme cases can still spill over into reality).

I agree that threatening someone's livelihood is bad, but in this specific example my immediate question would be "what were you or your customers doing?" If it's even remotely in the grey area of the TOS (however foolish/restrictive that may be), the owner has a responsibility to consider alternatives up front and communicate the potential for those to be necessary to customers.

This happened to us multiple times too. Everything gets resolved after 1+ months of having our payouts frozen. This means we have to go months without a single dollar being deposited into our bank account. Imagine having bank loans to pay and the bank is asking, "What the hell is going on?".

They need to nuke all their "X Verification APIs" and just manually check each and every account. For us, it was an issue with the Address Verification API not finding our address. As if addresses are a fixed thing and not dynamic. I also felt like I was going crazy because they would trigger it every 3 months or so, even after resolving the issue after speaking for weeks with the support team.

This happened to us in both Stripe and Shopify (which I think uses Stripe as its backend).

> They need to nuke all their "X Verification APIs" and just manually check each and every account.

Wouldn't they then just be another one of the more old school merchant service providers, who still exist for you to use if you're open to paying for being underwritten up front? The point of Stripe et al is to be cheap, quick and easy in comparison (for the happy path, anyway) through more automation, with the drawback of these types of failure modes.

We've done business with many "old school" merchant service providers and none have had us pay anything upfront. The only difference is that Stripe has a better API. Stripe's onboarding is not faster or cheaper than the other merchants by "automating". In fact, time-to-first-payout is much slower, less reliable, and the fees are much more expensive than any of our other providers.

I work at Stripe. Could you email me at edwin@stripe.com and I can dig into this?

Here it is! The raison d'etre of these posts to HN!

Bless Edwin for being here for us, always, time after time, but what a sad state of affairs.

Edwin has saved me before too. Love Edwin.

I'm proud to announce that Edwin officially pulled through for us today. All our accounts have been reactivated.

There are clearly problems at Stripe. But this kind human is not one of them.

You need to explain what happened, and what sector you operate in. Doing this support stuff on HN as a last resort & getting on the front page is crap in the first place, not feeding back is even worse.

Edwin broke it down here: https://news.ycombinator.com/item?id=32859520

I would still recommend you change your payment backend to direct your customer payments via one or more "backup" processors asap. Perhaps leave Stripe altogether if you prefer, once that's done, or keep Stripe around as the backup.

After all, they have a track record of screwing you over again, after fixing and checking your account. Whatever triggered that could do it again when you least expect it, despite Edwin's good work. Probably the triggers haven't changed as you are still running the same business.

(Like several other commenters, I was thinking of using Stripe as a main payment processor before seeing this article because of their great API, documentation, test mode and ease of setup. They seemed like a good choice, but I had wrongly assumed they were reasonable and reliable and if there were issues they could be resolved; that I didn't need to worry about Stripe being shady themselves. Now I've learned Stripe is like the Paypal of old when it comes to killing a business abruptly with no warning or recourse. That's so severe it cancels out every benefit and feature. With much disappointment I now feel it will be necessary to evaluate other services instead.)

Someone reaching out in this case is nice but what about folks who can't get their complaint to the top of the HN front page? I'm hopeful the OP gets everything sorted out but these no-warning, no-explanation, no-recourse suspensions need to be prohibited when the only thing a company says is "TOS violation."

Completely agreed. In the past, my employer has been in the same position with a different platform and to say it is an existential and Kafkesque nightmare is an understatement.

There's a variety of cases where the only legal messaging around the suspension is approximately that. Whether or not Stripe is doing wrong here, they do have to comply with US law and that type of law will result in that shape of suspension and therefore this type of story appearing on HN.

It is nice that people can get a quick fix by hitting the front page here, but for the rest of the community we have to realize that this is does nothing to fix the systemic issue (of course I'm just stating the obvious here, but might as well make it explicit).

You should ask OP first for their email; right now anyone can email you claiming to be OP.

Does that really matter much? There will be additional account authentication after an email is sent, and half of hacker news at this point already knows “email patio11 or Edwin for stripe support”

They could verify by having OP change their "about" text, here on HN.

Or just anyone with an issue actually ...

.. and then it would become a bit unmanageable for 'edwin', and then they would have to create support@stripe.com or whatever (like literally every other company on earth) and set up an appropriate way of dealing with customer complaints.

You’re a nice guy to try and solve OP’s problem. But OP’s problem isn’t really the problem. The problem is that OP’s problem is reposted here weekly by someone new and they have to pray that you or someone else use backchannels to solve their hellish issue. There’s a meta-problem. Can you just dig into that problem instead? Then you won’t have to dig into these sub-problems once a week.

I'm sure OP would prefer he dig into the specific problem first

What we really need is some sort of default arbitrator for cases like this. Support gives no answers because "reasons" too frequently for too many business critical applications and the courts are too slow to fix the problem and building in redundancy too costly to compete for most integrations.

Your support process shouldn't be so fundamentally broken that it requires this to get a resolution. I'm sure this same situation has played out with thousands of devs/merchants that don't even know HN exists.

In case this helps, this thread (and others like it) have convinced me never to use Stripe. There needs to be an official, public policy posted to Stripe's website that outlines transparency over deactivations and the process for resolution.

Hi, we are facing the same story for one of our CONNECT customers. This customer is simply a garden that sells tickets to visit the garden. Somehow Stripe connected that with cannabis sales. There is no cannabis anywhere on their garden. Now sure what kicked off this account closer.

Worst part is not that the account was closed. Worst part is that Stripe is not asking or giving any proofs/comments/data. They are simply sending templated replies. Its like talking to a robot while someones livelihood may be connected to this being resolved.

Also overall our dispute ratio is almost Zero. People visiting gardens dont dispute their visits. So frustrating.

Could you email me at edwin@stripe.com with a link to this post and we can dig into this?

Emailing now. Was trying to resolve it with support. For a while they sent non templated emails. Now its back to templates.

OP: I have even scraier email where Stripe decide to ban my account and it happens twice.

https://news.ycombinator.com/item?id=21306225 https://news.ycombinator.com/item?id=26320429

In both case https://news.ycombinator.com/user?id=edwinwee Edwinww is a huge help and Im highly recomend to reach out to him.

Without Edwinwee my SaaS might never see life.

I'm sorry this is impacting your business, but I can't help but notice something missing from your account: a clear claim that your business (and your customers' businesses) are fully compliant [to the best of your knowledge] with Stripe's ToS.

That might be an oversight on your part or "something that goes without saying", but when your counter to the accounts being flagged "as not in compliance with Stripe's ToS" does not include "hell yes, they're/we're in compliance with the ToS", it leaves me wondering whether you're in a grey or dark grey area here.

Are you facilitating the use of Stripe's API for accounts that are wholly owned by your customers or are you offering the use of your Stripe relationship for managing multiple accounts that you hold in custody for your customers? For the former, I think you shouldn't take responsibility for Stripe's behavior toward your customers, but you should have them set up an additional merchant account somewhere else. For the latter, I can see how that would put someone into a situation that might be both open to abuse and against the TOS.

Shutting down old operational business without personal convo with owner/manager is something that blows my mind when I deal with modern services. They advertise "customer-oriented" approach, "amazing 24/7 support", put monkeys on 1st line of support whose only goal is to kick your inquiry out as fast as possible.

Not sure how long it will take to understand that good support is not the one that tells how you are "important" to them when you call, but the one that actually mediates the problem before it becomes so.

As central as credit card processing is to many companies, why don’t those businesses maintain relationships with multiple card processors so that if one goes out you have a second ready to step in?

This is bad - but the worst part is that due to this trending on HN, I’m willing to put $50 down on that you’ve received some sort of personal or special message from Stripe support; for PR’s sake, so you can say someone reached out and resolved the issue.

Which is total bullshit. If you hadn’t, or didn’t really have the means to; create such a hubbub on social media about this - your issue would never have been resolved.

I actually think it’s worse when companies do this, rather than fix the clear, underlying support problem.

Have you tried https://www.amberflo.io/ for a metering and billing platform? you can decouple yourself from the payments providers and own the usage and billing data. In this architecture, events are ingested, aggregated, and shown back to your users, while integrating with payment gateways like stripe. We are working on such a platform

The discussion here is very interesting. Many mentions the idea to not put all your eggs in the same (Stripe) basket. I agree with it, but how?

You can not just store the credit card of your user (or have to go through a heavy compliance), and using services like Killbill.io or GetLago.com is just moving the single point of failure to another place.

How would you ensure that you are not 100% relying on a specific payment provider, without keeping all the credit card informations of your users?

Kill Bill (note: I'm a co-founder) provides payment routing capabilities, so you can integrate with multiple providers (e.g. Stripe + Adyen) and shift payment traffic to go through one or the other dynamically. This is very common in large b2c companies.

That being said, to your point, this still requires either a vendor neutral vault for the cards or to tokenize them in all of the vendors. Possible, but still hard to do in practice.

Yeah,that's what I think too : It seems hard (impossible) to register user's credit card at each payment provider (Stripe, Adyen, etc) and then start a subscription at some place (Stripe) and automatically switch in case of issues. There is high probability that in this scenario, Adyen will see the credit card refused because it never did a single payment for, say, 2 years, and suddenly starts a 300$ monthly subscription.

And I'm not even talking about 3D Secure!

As mentioned in the comments, a solution would be to migrate from Stripe to a merchant account with a bank where your service is vetted upfront.

I think it has come the time for the internet community to start calculating customer service as an integral part of the quality of the service, I understand this post is about generating momentum and having the issue analysed by them sooner but its became silly to have to post on forums in order to get support, if a company sucks in terms of support, just look for something else

BTCPay Server is a self-hosted, open-source cryptocurrency payment processor. It's secure, private, censorship-resistant and free.

My account was disable for dealing with "controlled substances" I told them, ok name one, they cant name one because i dont deal with any controlled substance, im just a market-market. They saw some molecules in my site, saw some weird looking website, and thats it this is too wierd for us. and took it down. now im calling them stupid over the emails

Maybe it's just some competitor using bots to falsely report you and/or your customers to ruin your business intentionally?

I've heard accusations of companies purposefully hiring bot farms to click on their competitors' ads and blow their budgets / get them dropped for excessive click fraud. It's rough out there.

This kind of stuff really scares me. I'm bootstrapping a SaaS and my big competitors could crush me real easy with stuff like this.

I'm about 90% certain it's an algorithm. This sounds like the classic PFA vs PD tradeoff...Stripe either lets the bad guys get away with using their "platform" for ill gotten gains or stripe stops the cretins while at the same time ruining people's lives.

And it looks like Stripe has been targeted by US State Attorneys frequently https://decrypt.co/42444/stripe-pays-120000-to-steer-clear-o.... So I can't fault them. They've got hundreds of thousands of irate algorithm victims that they're dealing with but those victims can't throw them in jail or seize their assets.

I’m really surprised that they’re allowed to operate this opaquely as a money transmitter. I’m not familiar with the specific regulations of holding a MTL, but you’d think with the amount of tight regulation we have in other areas (eg real estate) that money transmission would at least require disclosure of account status in a timely manner.

A little off topic but just like the suggestions here to have multiple payment processors, in your personal life have multiple checking accounts at different banks. Many banks are shutting down accounts for no apparent reason most likely due to AML and KYC. Your money can be tied up and you have no way to pay bills or get cash.

Revolut did this to me when I needed the balance to pay my rent. Locked account, no reason given.

7 days(!) of interactions with their support (chat via the app, the only option), sending numerous photos of cards and other things at their request, yet my account remained locked.

Eventually what worked was posting to their Facebook social media, then it was resolved within 20 minutes.

I still use Revolut because it has convenient features, but I won't keep a significant balance in the account any more, in case it is randomly locked again.

Occasionally their marketing suggests I make it my main account and salary destination. Maybe open a business account. Ha!

At what point does it make sense to sue these companies to compel them to answer these questions? I know, that's expensive... but I'm willing to contribute to a legal fund to make payment processors answer questions.

I’ll contribute a few hundred bucks too

Of course a logical question is: with whom do you set up a "Fund me" drive to sue the likes of PayPal and Stripe?

Usually you would start with a “lawyer letter” and hope it adds some urgency to resolving your issue. Those are way faster and cheaper than actually filing suit.

A law firm probably has an escrow account set up for this.

I second this!

Also, a lobbying effort should be funded, to compel these companies by law to provide detailed feedback.

Same here... from a developing country, but still will contribute. These kind of actions by such monopolies piss me off badly.

Go sue them. Also, cannot a class-action lawsuit be initiated against them? We already have many people going through such cases...?

Hint: at this point. Right here. Right now.

Corporations that provide critical services that would otherwise be hard to find elsewhere (Stripe, perhaps) use these legal threats to completely shut their customers out of their closed ecosystems. If you hold them to account, you pay a stiff penalty on the other end being denied access to the services they monopolize. And you are very likely compelled to operate using their arbitration schemes and you will have no path to swift action. I don't know how to get around this and it remains the primary reason I walk away from companies that operate terribly with their customers (I see you, AirBnB -- https://www.airbnbhell.com/), but who provide services that I sometimes really need. I'd love to understand from a lawyer what REAL paths customers have to finding swift and fair (I should lose sometimes too!) justice without an extra-judicial penalty put down by a company operating a semi-monopoly.

> If you hold them to account, you pay a stiff penalty on the other end being denied access to the services they monopolize.

Looks like they've already paid that penalty

I'm not sure if suing is a reasonable way to go - suing would work if there's a legal right to continued service or "answers" but IMHO there is not, technically for such B2B deals Stripe has the legal right to say "you haven't broken any explicit restriction or terms of service, but we simply decided to terminate the contract because we didn't like your business" or "we threw a bunch of dice and arbitrarily chose to".

This sounds more like incompetence than censorship at first glance, but FYI, there are alternatives with explicit ambitions of being more trustworthy partners in payment processing: https://www.paralleleconomy.com/

Can I ask what the line of business is? I'm not victim blaming I am curious if this is part of the issue.

May I ask what your business and business model is, just to get a better understanding of the whole situation?

Is there an alternative to Stripe/Paypal that don't suck from a customer service support angle?

Suffering with a very similar situation but from Facebook. This hyper growth companies don't give a shit about customer support. They let their AIs and Machine learning models do all the work, which inevitably flags healthy businesses.

Reminds me of collateral damage and kills in a war.

Let at least the long-term customers pay later, or let them use your product for free while you set up another payment processor. You may ask your customers, which payment options work for them, and use that as help to pick a more reliable alternative.

Just out of curiosity does stripe offer a paid support model? Are you guys paying for it?

Stripe did something similar to our company so we switched to Parallel Economy (https://www.paralleleconomy.com). We've been happy with it so far.

Do they have API docs you're aware of? Started the application process but they want to lock you into a monthly fee/termination fee scheme without really explaining how their service works.

"Horror" stories like this one are not uncommon, and assuming you are in the right, I'm sorry that this is happening to you.

If I were you, I'd do two drastic things: one, switch to another payment solution, and two, sue Stripe.

A decade ago this story would have been about PayPal. In fact, I remember stories that are almost identical from that time period.

I wonder what new payment system that's "not a bank" this story will be about in a decade from now.

It’s becoming increasingly clear that we cannot rely on big centralized payment processors. First it was PayPal, now it’s Stripe.

I know HN has a natural dislike to anything crypto, but I really hope crypto can eventually bypass this bullshit

This is not a support forum. If you wanted some sympathy or actual decent conversation about what’s happened to you, then you’d include the industries involved / products etc. I do wonder why you didn’t.

Counterpoint: HN (and Twitter) certainly seems to be the complaint forum of last resort for Stripe, Google, some AWS issues, and so forth.

> I feel like I'm going crazy over here. These accounts have hundreds of thousands of dollars in them being held hostage by an utterly incompetent team / algorithm that seems to lack any and all empathy for the havoc they wreak on businesses when they pull the rug out from under them with no warning, nor for the impact they have on customers when they all of a sudden lose all ability to make money. And all that for an account that has been using Stripe for nearly 7 years without issue!

When people on HN swear up and down that Bitcoin has zero use cases, I think some may be voluntarily forgetting stuff like this.

Is Bitcoin a perfect fit here? Probably not. Does it eliminate the problem of arbitrary algorithms blocking payments for no discernible reason? Yes.

Don't wait for a response. Swap out stripe for something else so that you can process payments. If they give a satisfactory response and restore you could switch back

After all the talk of disruption and innovation that we are subjected to these universe brains suddenly turn into troglodytes when it comes to these things. I wonder why.

I'm glad to see that from comments on threads like these that the cargo-cult worship of Stripe is starting to crack.

Same goes for PayPal, Google, Mailchimp, and all the others.

Step 1: Find a new payments processor, get the customers back online, and then see if it's worth switching <em>back</em> to Stripe.

in AU, we have something called Financial Ombudsman Service by Australian Financial Complaints Authority (AFCA), I had similar issue with paypal (with a much smaller scale), then support didn't want to help me. I complained to AFCA, scared the shit out of them, then got all my money back.

I assume US has something similar to address issue like this where financial platform is acting like this?

Just switch to a different merchant. This entire post seems weird to me because it seems like you are doing nothing here but just being a middleman in between Stripe and people who need to process payments lol. Why cant they just enable Stripe themselves?

>So currently, my product doesn't work for 35% of my customers. Cue torrent of pissed off customer emails.

Okay? You should have always had a plan for this bc its bound to happen eventually. Switch them to a new merchant or drop them as clients and take the heat. The cost of just being a middleman.

I presume they are using Stripe Connect and are trying to help their customers who have their individual Stripe accounts blocked.

> Just switch to a different merchant.

Yes because that is so simple and there are so many competitors that provide the same level of service /s. Also there is no guarantee anyone else in this space is better than Stripe (when it comes to customer service). I can tell you the company I attempted to switch to had terrible docs, a bad API, horrible support, oh, and their shit just didn't work randomly. This is not clear-cut or simple.

> You should have always had a plan for this bc its bound to happen eventually.

Throw some victim blaming in as well for good measure.

> The cost of just being a middleman.

Middleman, aka providing a platform that uses payments? That's what we are calling a "middleman" now?

What's your business model? Sounds like you're a high risk merchant. You don't get to use nice things like Stripe.

You are the product not a customer. The customer is their investors, you just provide transactions to skim on their behalf.

They probably have put you some country's "national security" review, possibly based on ethnic profiling.

Check out Recurly as a alternative to stripe.

Something similar happened to me last month.

Did you get this resolved? If not, could you forward to me at edwin@stripe.com?

yes, it was resolved, thanks for asking and for offering an email address.

This is Stripe now. While 7 years ago their customer support was top class. It’s absolutely bottom of the barrel now.

> not in compliance with Stripe's ToS

If it's not up to their ToS, they owe you. You can ask for a refund, or sue them.

Avoid SPOF's (single points of failure).

Relying on one dependency, Stripe, for 100% of your payments, would be an example.

since you are a business, simply sue their asses for damages. don't play nice with them if they don't play nice with you. they didn't give you any notice in advance so you had no recourse to change providers in time to avoid accruing damages.

Happened to my startup too. But the alternatives turned out to be even worse. We capitulated.

How much stories like this do we need to accept that this shit must be regulated?

Well, never using stripe then. never recommending them either.

[Insert name] from Stripe here... [Insert apology] [Insert vague explanation] [Insert promise to investigate and resolve]

He beat you by about 5 minutes! https://news.ycombinator.com/item?id=32854831

Who says it will only be Edwin?

What is the alternative? I had the same issue with Paypal.

Can you sue them to get the money unlocked, and in the meantime switch to cryptocurrency? I recommend using one with fast block times, such as Algorand which is going to be 3.7 seconds in a few days.

This happened to NewProject2 awhile ago - but the owners were hated for being political dissidents, so no one helped them. Now that it's happening to you... Sucks, doesn't it?

If only there were some kind of permissionless, censorship resistant payments system, so that we could operate our businesses without being arbitrarily crushed by faceless corporations.

There is none. Everything can be censured, including Bitcoin to which you implied with this comment.

> You cannot call Stripe. They do not have a phone number. Their support page on their website has Phone call and messaging grayed out.

There you have it. Their core business model is to process payments for their own customers and they are gaslighting them with passion.

Lesson for all of us: We all are working to get paid, so before you finalize your payment processor and start the integration, make sure you are able to reach out to them via multiple mediums - phone/chat/email.

I believe it's time to show these idiots at S - how it's done. I've heard their founders talk, they come across as over-grown kindergarten kids. S to graveyard. The story of past.

What payment processors are safe to rely on?

Could a report to the CFPB move the needle?

I am curious -- what is your product?

Stripe CEO Patrick Collison:

"What is happening?" => basically, a major uptick in attempted fraud over the first half of this year that necessitated making our systems stricter. But have an idea for a structural fix here. More soon. (DM me if you've had problems on this front.)

https://twitter.com/patrickc/status/1550136569482252289

That tweet was posted in July about a different case. At least I assume it was different.

Why is it still possible to commit so much fraud with credit cards? Where is the second factor for CC use online or some other more secure way?

When I use my VISA chip and pin credit card online I sometimes depending on merchant/amount/etc have to approve the transaction via the credit card app. Should this be the defacto standard?

It's because merchants tolerate a certain amount of fraud loss in order to reduce friction for the customer when making a payment. The same reason nobody ever checks you ID when you pay with a credit card in a store (unless you're in Vegas where they seem to do that, for some reason).

Avoid Stripe at all costs.

EL OH EFFING EL

CHICKEN. EGGS. BASKET. ETC.

there is someone sanitizing its kyc. simple as that, hehehe

yikes. i never really thought about backup vendors

What sort of business do your run?

I'm considering using stripe connect for something very tame (like a gig economy thing) and I've looked into it and I really want to use standard accounts because I don't like how the liability shifts to me for custom and Express accounts.

Sure, the customized user experience for those is quite nice but I don't really care about that I just want to ensure I can have the best possible relationship with a payment processor.

Honestly I love stripe like how they made s** easy for me. I had my first case of fraud the other day and it's just so easy to refund it and all the tools they provide I just feel so safe like they protected me from whatever bad s** could have happened if I hadn't you know handled this potential fraud well.

Personally I found their email support to be really comprehensive and just really top-notch awesome and their chat support to be more responsive and more generalized but still good. So my suggestion is like maybe if you have a serious issue maybe email support is a good way to go I mean just an idea.

The thing about standard accounts for connect is all of that interaction on the client's account gets deactivated or something you're not responsible for trying to pick that up like that's between the customer and strive so I mean maybe it's not a great experience for your customers but for the longevity of your business and for the experience of all your customers you can basically say sorry you know you have to take this up with stripe there's nothing we can do. Maybe I don't have the correct info but that's how I understand it.

The way I see these payment processors though is like my connect business will exist at the benefiance and generosity at the grace of the king. I mean I basically have to you keep the kings of the stripe empire happy because you know my upcoming connect business is completely dependent on them. So I think that's going to be in my thinking like rather than just thinking all I have to do everything to satisfy customers my first customer will actually be stripe so I have to do everything to satisfy them and then I have to do everything to satisfy customers. to some people that may not sound ideal but I just see that as the reality.

At the same time in the long term because of how these things can occur like your business got nuked, I've read of other people's businesses getting cancelled... I'm sure there are processes behind it but like I have the feeling of fear like this could just happen to me one day even if I'm trying to do everything right.

Maybe it couldn't but I have that fear and I think I need to take precautions for that so basically I think I have to keep a good relationship with stripe but at the same time I want to develop a way to like have a button that I can switch and, "okay stripe bans me" and I can switch over like technical redundancy to another payment processor.

Even then I don't think is a foolproof strategy because I mean I'm sure all the big payment processes are kind of in League with each other and in communication with each other to some extent so you there may be some you know you'll get sort of banned by a whole clique of them or something but ... like other people have said here it seems there are payment processes who take on business who have been kicked out of stripe.

---

Also no offense but my impression from Reading striped docs is like if they're going to you know be banning connect accounts or you know having issues with payments then you'll get some sort of warnings about like early forward warning or you know you'll get requests for information you know for compliance purposes for those connect accounts I don't know my sense is like maybe you just thought those requests or those notifications or just not important you know you got your business to run you don't have time for this you're sure that all your customers are legitimate you know you feel you can vouch for them and so your attitude was it doesn't f*** matter I don't have to do this. I mean maybe so you're saying their support wasn't responsive but maybe my feeling is you probably might not have been responsive in the past.

That's just my sense but you know I might be incorrect about that and I think it just kind of is reassuring for me to think that's the case because then I can think well I can do better you know I can have a a more assured relationship with them then what I've read about. Anyway that's my take on it you got to try to be prepared but I certainly offer a lot of good stuff.

Ugh... why is Google's voice typing so not good.

1) It doesn't seem to learn.

2) I think it was better a couple years ago.

3) The transcription seems very slow. But I remember a couple years ago it was lightning fast.

Any settings or premium version that can be signed up for?

From my experience it sounds like one of your clients or even you are considered for doing fraudulent transactions... a bank would do the same.

Welcome to the world of anti-crime finance rules.

You are guilty until someone decides otherwise on their whim.

Welcome to the cloud! This is the kind of thing that happens when everyone follows the siren song of cloud computing. I certainly understand the draw of these offerings (access, easy configuration, scalability, low initial cost, etc.) but you are handing control of all your processes and data to a centralized entity who can jerk you around any time they want and doesn't have to account when they make a mistake.

The pendulum of centralized vs de-centralized architectures has been swinging full tilt in the direction of centralized for some time. It is stuff like this which will eventually swing it back the other way.

Is there a self-hosted payment gateway that just works?

I hear you about cloud dependencies, but this isn't one of those cases.

I wasn't suggesting that there are decentralized options for every cloud dependency that is viable today. I am just saying that it is issues like this one which will drive innovation toward solutions that do not require you to put your fate in the hands of some central authority.

Fair enough, payments (credit cards, in particular) is a particularly hard area to decentralize... or at least democratize a bit more.

I'd love for an open payment standard for p2p payments and individual-to-business/institution payments to become available so that individuals could establish their own connection point to a fair payment exchange network.

This will only come with regulation that forces it, though. See India's UPI system, for example.

You didn't say how it ended, is it still ongoing?

I assume it's still happening since he posted this 13 minutes ago (at my posting of this).

Reading about these kinds of issues strengthens my belief that ecommerce using stablecoins is the way forward.

If only the blockchain were powered by crypto users’ endless supply of confirmation bias.

Please do tell your alternative plan for allowing anyone to join the market (permissionless) while also preventing counterfeiting

Stories like this are why ultimately all payments will transition to crypto based and self custody. Having your livelihood at the whim of an algorithm is not only not cool. It is not sustainable. None of the legacy payment rails can be trusted to run without interruption. This includes Stripe, paypal and even the expected FedNOW service being introduced next year.

Self custody means having/being a custodian that does not make mistakes, ever. That is not sustainable either.

> Having your livelihood at the whim of an algorithm is not only not cool. It is not sustainable.

Yeah!

> all payments will transition to crypto based and self custody

But... but... you said...

Agreed, the no intermediary for a payment is a beautiful use case.

However I acknowledge the issue with volatility (to be solved!).

I think volatility will go down over time as crypto becomes more normal and boring.

You'd think stories like this call for standardization of payment processors (using APIs such that changing providers is possible in an instant), as an extension of monetary sovereignty, mandated by law.

Reply on news.ycombinator.com