Hacker News Reader

Comment by dubcanada | Hacker News Reader

Stripe is extremely bad at fraud. I have a company that continues to charge my credit card monthly, their website and email do not work anymore. I continue to charge back them every single month, and Stripe continues to charge my card. This has been going on for about 7 months now. If I ask them to help, they tell me to contact AMEX, I contact AMEX they tell me to contact Stripe.

The website doesn't work, the email doesn't work, I charge it back every single month, yet Stripe doesn't care one bit.

Attempting to contact Stripe results in emails asking if I need help resetting my password (yes I legit sent an email asking for them to investigate the "company" and they sent back a reply with details on how to reset my password), to telling me to contact my credit card provider.

Honestly both companies are giant bags of turds, if you can you should look elsewhere, you can save money on almost every fee, there are alternatives to every single product they provide, and pretty much all of the alternatives are varying degrees of better or cheaper.

View on HN

I have a perspective from the other end of this, as a seller. Been using Stripe for 5 years selling digital content with a low, $5 average bill. A year ago the site was likely noticed by hackers who started punching in dozens of stolen credit cards. I kept refunding manually at first, but then I had activated Stripe Radar. It made absolutely zero difference out of the box. "-Is it a 100th charge coming from the same IP in Ukraine with a Canadian VISA? No problem, charge approved, here's your success webhook.". "-Same fake TLD for the email address, for a customer number 2235? Nothing suspicious here, charge approved.".

What helped fight this was to create a rule in Radar to reject all cards without 3D Secure capability, but it had cut off a sizable chunk of legit revenue.

This is the big problem with Stripe's positioning in the payments food chain ladder.

Block every single fraudulent or suspicious transaction, and you're leaving obscene amounts of money on the table.

The amount of credit card fraud that goes unclaimed or is eaten by liability shift is huge, so if Stripe makes a product like Radar ACTUALLY WORK, they would be missing out big time.

I am confident Stripe's radar's shortcomings are deliberate and not simple bugs or design problems.

It appears they have no incentive for the product to be 100% effective and that would explain why Stripe Radar is billed per screened transaction, regardless of outcome.

We benchmark Stripe Radar against other pure play fraud fingerprinting solutions, and the difference is abysmal. The fact that Stripe claims to have seen 80% of any card before it gets to your store make this fact even worse.

So, like parent says, you are going to see radar scores of 90 and 95 for certain charges (clearly fraudulent carding attempts), followed by scores of 15 or 20 for the same card, IP, fingerprint with absolutely no warning.

I've grown tired of escalating this to Support. They just give me the ML model answer. Basically: "It's a black box!"

You can definitely add a rule to start blocking charges from X places, or with Y velocity, or always enforce 3DS, but then you're taking the model into your own hands, and that has some important consequences.

Your acceptance rate goes down. You're heavily interfering with the model and relying (and trusting) it less, and you realise you really don't need Radar to do that for you.

If you're serious about fraud, you must use a pure player solution that is 100% aligned with your interests.

From what we've seen with Stripe Radar in the past, that doesn't seem to be the case.

I'm a big fan of Stripe in may ways, but I really have a love/hate relationship with this side of their business...

Agreed - I remember working on something that only service Australian customers and charged in Australian dollars, but Stripe didn't do much when there was a massive influx of overseas cards charging in US dollars.

Stripe Radar costing money is a bit annoying too - my solution was to block non-Australian cards - but the only way to do that is with Radar, which costs money. Radar doesn't let you whitelist currencies either.

Is there no way to get Stripe to automatically refund all chargebacks/disputes? What if you're only getting a 5% fraud rate for something cheap and you want to just eat the loss and not have to manually deal with disputes? Or if you're selling something like a premium online account, you can just disable the user's account automatically if they dispute the charge.

5% is huge. Like, ban your business from taking credit cards huge.

So you're saying all I need to do to knock a business offline is spam it with enough fraudulent CC numbers?

Yes you might be able to do that, at the risk of some personal liability because this is illegal. It’s also grossly unethical.

If your fraud has a large enough monetary value, large enough scale, or you work with another person on it, you can get hit with a serious felony charge and end up in prison for a few years. Disclaimer: I am not a lawyer or expert on credit card fraud.

I think people don't realize how much of the economy relies on agreements to not be a piece of shit.

Sort of like the highway system relies on an agreement not to play bumper-cars. There's nothing actually stopping anyone.

> There's nothing actually stopping anyone.

Self-preservation.

Yup, that's an attack that exists and is used regularly. It's not trivial to pull off, but is easy/accessible enough that competitors will sometimes do this to each other's web shops (I've heard of two cases of this just in last 3 years and that's in a city of only 300k people).

This is exactly the big issue no one is talking about. We are putting more and more pseudo security in customer protection but as a seller I am always in constant danger.

A chargeback with stripe costs like $15 for the seller. Even if the charge was only $1.5. Imagine the monetary problems you could create and the seller has no other way than to pay and hope to not get banned.

We're actually working to provide this functionality as a service but it's currently stealth so I can't get into much more detail.

Yep. Anything greater than 1% is leading to trouble such as huge fees or being kicked off a card network.

I have seen a business run with this dealing with mobile phones targeted by organised fraudsters. Moving "too fast" to notice and whoops profit is £0.2m not £3m.

> What if you're only getting a 5% fraud rate for something cheap

Something cheap turns into a $15 dispute fee.

Disputes automatically refund the amount disputed plus the fee. The onus is on the merchant to fight the dispute and claw the money back.

(Disclaimer: I used to work at Stripe on the dispute resolution team. I no longer work at Stripe.)

This is another case of the old assumption that businesses have more resources than their customers. It's something everyone in the financial/banking sector seems to assume and it drives me crazy. I run a nonprofit with less than 5000€ income yearly and a handful of volunteers. We have less time and money than one average person who wants to buy something from us or donate. If we got hit by a chargeback storm, we'd go bankrupt in a week.

The same thing happened to me. My solution was to block an IP address from making a purchase after N failed card attempts. It worked well enough to get me back off of the radar of those scammers.

What do the scammers get out of buying your stuff with a stolen credit card? You get the funds, but what do they get?

It's called card running. You get a trove of credit cards, so you use them to buy tiny things that the card holders hopefully won't notice. Now you've sorted the list into valid and invalid cards, and can resell the valid list for a lot more money to a scammer who will use it for large scale fraud.

For example, they now know that the CC number they purchased in bulk is authentic.

Just to explain, people selling stolen cards have a reputation that makes them money. If they have a reputation for selling cards that have already been burned, they can’t sell each card for as much. But, I’d they have a good way to test their cards, they can get a reputation for only selling cards that still work. This lets them sell each card for multiples of what a fraudster with a bad reputation can charge.

I have no idea why it works this way these days, online fraud should have been solved a long long time ago with technology. The banks/mastercard/visa have the ability to mandate much better security mechanisms (3D Secure etc., 2FA, generating some secure token for any large purchases etc.) so why aren't these compulsory?

The first bank to only authorize purchases with 3DSecure lowers the fraud rate a lot, but people with multiple cards will mostly choose to use other cards, because it's less friction.

Anyway, the merchant eats fraud for card not present transactions. So why would the bank choose to reduce its payment volume in order to reduce fraud it doesn't even have to pay for?

If the merchant says 3D Secure only, it reduces fraud, but also reduces payment volume, because most customers will choose to use a merchant with less friction, especially if their issuing bank doesn't do 3D Secure, or it's broken when they go to purchase.

Reducing fraud is good for merchants, but it the drop in sales may not be worth it. There's a lot of other things merchants can do to reduce fraud that aren't likely to cut into sales as much.

Having worked on the banking side, I’d say it’s because bankers hate technology. You’d be amazed at what some people will do to avoid it. I had one guy retire in 2005. When a new account manager took over his clients, we learned he’d been telling all of them the bank didn’t have email. Just because he didn’t want to adopt it.

This is similar to all the 'empty' spam calls people get. They are just probing for validity, so they can use or sell it later,

And as these additional security settings get more normal it's get harder and sometimes even impossible to pay for your services when you are not in your home country.

What's a payment method actually worth where you have so little control if the payment succeeds?

I really like how they implemented this in India. Due to recent central bank changes, all recurring subscriptions need customer notification before the card is charged. So before a recurring charge occurs (1 day before), they send a sms with a link to cancel that charge if required. Also now most credit cards are providing a single place to manage all subscriptions. So you can approve requests for recurring authorisation (first time) and also delete an existing recurring charge with a single click. Not to mention to be able to see who all are charging or going to charge you recurring in the first place.

To add, the retailers are not allowed to store any card details, like number, dates etc now. They are required to send all these to bank first time, and they get a token only. Next time of a recurring transaction, they simply send this token to bank to charge money.

Customer can see these tokens anytime, along with merchant details, and customer can revoke these tokens anytime.

This is a fantastic idea! Wish it were here in the US. In some areas like fintech/banking it appears "developing" economies like India are light years ahead of us.

There are benefits to being late to market. The US also has close to 5000 banks and nearly as many credit unions, whereas most 'developing' economies have only a handful. Banks have to follow state and federal rules (sometimes both, sometimes only one or the other, depending on the rules and the corporate details). Centralization into only a few firms and maybe a single regulator makes it easier to have consistent features and requirements.

The EU should adopt this.

The US too! This sounds great. Even better would be a recurring subscriptions management panel provided by the credit card issuer. Then you could cancel from there, and the service provider would be notified.

The EU already has this but for some insane reason there are no electronic SEPA mandates only paper ones, also you must request the cancellation of the SEPA mandate from the merchant.

I had been using Stripe for a short time a couple of years back. I looked into collecting sponsorships and donations for OSS development via BuyMeACoffee (I strongly advise against them).

As expected, just a couple of bucks accumulated. Then a user sent an unsolicited $15 donation, along with an accompanying comment, asking for macOS user support, for help solving a user issue entirely unrelated to my project. I declined, explained the situation and offered to refund the donation. I never received a reply, but immediately after, I received a chargeback notification. Stripe took the $15 from my account as well as a $15 chargeback fee. The user claimed fraud. An appeal went unanswered, despite me providing all required proof.

In the end, this little experiment cost me money. It also opens up a disturbing avenue of hurting someone financially, given enough credit cards and chargebacks.

It is important to note that Stripe is a wrapper around Wells Fargo.

This means it's an 800 pound gorilla in a dev/bay friendly costume (docs? API?).

They cannot fix the financial system unless they can become Wells. That will not happen. Thus, their actions, pricing, and product development choices all point to Wells.

PayPal has this exact theme of a problem. Or lack of solving.

Would something like Column [0] be a solution here in regards to it being a Wells Fargo problem?

[0]

* https://news.ycombinator.com/item?id=31109170

* https://column.com/

From your description, this is solidly Amex’s problem, and all of your contact should be with Amex (or with the merchant you can’t reach). I have no idea why they would tell you to contact a merchants credit card processor. In fact it’s such a bizarre instruction from Amex, it makes me wonder how you described this to Amex.

I am curious about your response, what do you think I should do differently? And why do you think this is AMEX's problem?

Also how should I describe a rather basic problem? I told them every aspect of it multiple times to multiple tiers of customer service. Email chains (or lack thereof), website details (include login), they already have transaction details.

I am not saying it's a 100% Stripes problem, I am wondering why I am able to chargeback it 7 times in a row, and that does not trigger any red flags. If a single customer chargebacks a "subscription" multiple times in a row, should that not be an immediate cancel?

Why can I not go to Stripe, fill out my credit card, and click cancel and cancel a subscription? They already have a portal to get transaction information, why not allow me to cancel. Since it's all webhooks anyways, what difference is it if it is through X merchant site or Stripe?

It's Amex's problem contractually. The contractual relationships here are:

customer -> card issuer (amex) -> card network (amex) <- card processor (stripe) <- merchant -> customer

So as you can see, you have no relationship with Stripe. Your have a relationship with Amex and the merchant. Those are your points of contact.

When you make a chargeback, Amex accepts this chargeback, and sends it to the merchant's processor, who then presents it to the merchant for response. This is a process defined in the contracts between each of the parties.

To your other question regarding fraud controls in this system, that's handled in the contracts:

- If you skip out on your debt, Amex must still pay for any charges they authorized. (The payment flow is customer -> Amex -> stripe -> merchant. This flow is reversed for a chargeback/refund.)

- If a merchant skips out, stripe is still responsible for any chargebacks.

Think about what this means: If stripe accepts too many high-risk merchants, they'll lose money. If Amex accepts too many high risk customers, they'll lose money. So they each have an interest in controlling fraud.

So what happens when a merchant gets too many chargebacks (typically less than 1%): Stripe will refuse to do business with that merchant. Why would they do this? Because if Stripe has too many chargebacks, the card network will refuse to do business with Stripe. They may be able to recertify as a high risk processor, but that comes with additional requirements... and if its above those high-risk levels, the card network won't allow stripe to process any payments at all.

This is all defined contractually.

What is the contract you have? You have a contract with Amex: your credit card terms. And you have either an implied or explicit contract with the merchant that they must meet.

Stripe and Amex are not fully aware of your contract with the merchant (refer to first relationship graph above). Part of the chargeback process is the merchant's response. A valid chargeback defense is that the charge meets the contractual terms the customer agreed to (assuming nothing illegal is going on). When the merchant presents the contract in their response, Stripe and Amex can review that contract. Amex (as the card issuer) gets to decide if they accept or reject the merchant's response and issue a decision on the chargeback. (Stripe (on behalf of the merchant) can disagree with this, and it then goes to the card network for a decision.)

So that's the whole process.

If you go to stripe directly (as a customer), you're attempting to do an end run around this contractually enforced process... and stripe isnt going to do that (unless they want to be sued for tortious interference by the merchant).

So hopefully you can see why Amex telling you to call Stripe is so bizarre. What makes it even more odd is that the type of dispute you have is something Amex handles like a 1000 times a day... they have a process for it.

And FYI: Amex can block a merchant from charging you in the future. (Easy on their part: just stop authorizing the charge from the merchant.)

I'm spoke to 12 regular customer service agents (over the months), and 2 managers at this point. How much further up the chain do I need to go? All of them said the exact same thing, "There is nothing more they can do, I need to contact the merchant (I cannot) or Stripe.". I've got it blocked every single time (I guess blocked is an attempt and does not guarantee it will be blocked) I called, and every dispute online via the checkbox.

While I believe everything you said, I have not experienced it.

Do you mention Stripe by name, or the concept of a payment processor at all?

Sometimes when I’m on with CS, if I let it slip that I know a little something about what’s wrong they take the easy out and send me on my way by regurgitating what I just said as the solution.

The average person doesn’t know anything about Stripe or payment processing. I find it hard to think Amex would steer you that way out of the blue.

Is Amex really saying “here’s a phone number to some third party, resolve it yourself”? Totally unprompted?

I would call in and pretend to be as dumb as possible. All you know is you keep getting charged and you don’t want the charges anymore. The business phone number you have is disconnected. Let them take it from there.

I’ll try to add some food for thought: customer service agents and their managers do not know everything. In fact, most of the times, they do not actually know how the products work. They just know what they’re told and they’re only told what they ask. But if they don’t know what to ask, then they can get caught in a situation where they just default to blaming you or someone else so they can close the ticket.

Your best bet is to get in contact with someone who is in sales who can escalate this to an engineer or other more technical person. One way to do this may be to declare that you will tell your customers AMEX is no longer acceptable unless they help you resolve the issue. This may seem harsh but I bet it would work at AMEX and not a VISA or Mastercard

I have a debit credit card. The only option I have to cancel fraudulent payments is closing the card and getting a new one for $40 and changing all my payment informations everywhere.

No idea why this is, and no idea why anyone would give out his data to unknown companies under this conditions.

Being 2 years into a complaint with amex, 'bizarre instructions' don't surprise me at all.

This sounds like a fun time to run an experiment with getting an injunction against Stripe. Next time it happens, rather than doing a chargeback, sue them for the actual amount in addition to all of your time spent dealing with it. Then seek a preliminary injunction preventing them from charging your card any longer. You can probably do this on your own, although it will be time-consuming.

At that point it becomes a legal problem for them and I suspect they'll be forced to take more serious action.

The only time it makes sense to sue in civil court is either:

- The damages in question would exceed hundreds of thousands of dollars

- You want to make an example out of the defendant and have lots of money to burn

- You are engaging in litigation as part of a settlement extortion scheme ala Prenda Law

America does not award legal fees to the victor - in fact, it's considered so un-American that American lawyers literally call it the British Rule[0]. As a result, small actors - which you almost certainly are - will bankrupt themselves just getting to the discovery phase, regardless of if they are plaintiffs or defendants.

In a few situations, this has become such a problem that US law either provides time-saving motions for common forms of nuisance lawsuits[1] or uses it as a way to encourage certain behaviors[2] out of litigants. However, this kind of fraud case will almost certainly not fall under such measures, and you are almost certainly too small to defend.

Representing yourself in court is technically possible but practically a death sentence to your case. And an actual lawyer would tell you exactly what I've told you, except with actual attorney-client privilege[3] involved, and they'd charge you for telling you that. Except they'd probably also add in a bunch of stuff about class-action waivers and binding arbitration[4] that would make it nearly impossible for them to represent you.

[0] I've also heard French Rule.

[1] Such as Anti-SLAPP motions, though these are not in federal law yet.

[2] The copyright registration system comes with a few key perks; notably statutory damages and the ability to recover attorney's fees. If you do not have either you cannot economically sue a copyright infringer, which sounds like a really good way to comply with Berne without complying with Berne.

[3] I am not a lawyer.

[4] For what it's worth, there are some crafty lawyers that have figured out a way to help people mass-arbitrate, but companies are trying to fight back against that too.

- You want to make an example out of the defendant and have time to burn

Sue them in small claims court. You won't get significant money, but they'll have to burn a little money on lawyers. You have the chance at the moral victory of the judge saying you're right*. You probably have a decent chance of getting on the HN front page when you first file and when you win/lose. You have a noticably higher chance at being covered in the mainstream media than if you just complain on the internet.

*The judge generally doesn't literally say you're right

For such a small transaction, in the US you're stuck with small claims courts, and iirc you generally aren't going to get any damages for your time there unless it somehow interfered with your work hours.

Since this is HN I will characteristically take my precious private moments sitting on the toilet to correct this wrong understanding on the internet. Small claims court is an additional option if the defendant lives in the same state and the amount is small. Civil court is always also an option even if small claims court also applies. So this reply makes no sense. You’re wrong. I know it hurts so bad but it’s okay because we are all wrong sometimes. So we will let it go this once there is no need to delete your account and make a new one. Small claims court is great for some things: I sued my ex land lord who wouldn’t return my deposit. Lawyers aren’t allowed and it’s usually open and shut. Anyway hope you have a great Thursday!

> unless it somehow interfered with your work hours

This doesn't sound like a particularly difficult bar to clear.

It is if you're not an hourly employee. In small claims courts, you need a pretty clear demonstration of actual damages. You don't get to just make up a number that sounds nice. Therapy bills from stress, maybe, but this scenario seems like it would be taking up an hour or so of time in a month. In any case, small claims courts usually try to get you to go through arbitration first, and stripe would almost certainly cave with a small offer since it would cost less than an hour of a lawyers time.

But then woudn't the poster be locked out of purchasing goods and services facilitated through Stripe?

This happened to me with Citibank. But, I called citibank and got a new card number. Then, citibank gave the new card number to the fraudsters when they tried to charge me the next month.

Unfortunately, I’m going through a divorce right now so I can’t cancel that credit card. But, as soon as I’m free that’s on the top of my list of things to do to start living the rest of my life.

Citibank probably didn’t give them the new card number. There’s a link somewhere between stripe and Citibank that is tied to your account and not the specific card

Citibank did. The major banks all participate in Visa, Mastercard, and Amex’s updater programs.

https://usa.visa.com/dam/VCOM/download/merchants/visa-accoun...

https://developer.mastercard.com/product/automatic-billing-u...

https://www.americanexpress.com/us/merchant/cardrefresher.ht...

It’s Citi’s fault for not flagging the change being for fraud reasons, which skips the updaters.

(Sam from Stripe here.) Sorry for the issues so far. Could you email me more details at smca[at]stripe.com? I'll dig into this.

I will send the full details/email chain tomorrow morning. I appreciate you looking into it, but why does this type of interaction require a HN article for a response? Why do none of the regular methods go anywhere?

They don’t care about fixing your payment problem. They care about fixing their PR problem.

Not to pile on poor Sam here. This is a common thing in the finance industry, and tech, and basically everywhere.

Putting out a fire on HN before it gets more press is something anyone would do so it basically means nothing. Now, if a founder commented on here "Don't bother sending me your details. I've un-fucked our support system, just submit a ticket again" that would get my respect.

I’ve talked to one of the founders of stripe on the phone after tweeting a complaint about their product. This was probably ~2014 but I’ve been an advocate for them ever since. It feels like a personal slight to read this blog post. Hopefully, they fix these issues because I like feeling good about using stripe.

Would PayPal give the same response? At least with Stripe you know if you kick up a stink on Hacker News someone there will respond, not that this is ideal but I wouldn't expect to hear from any PayPal employees here.

Last time this happened, OP replied to the Stripe guy something like "you said the same thing when i mentioned this on HN three months ago, i emailed you, and nothing happened". So with Stripe you might well get a response here, but that's not to say you'll actually get a resolution to your problem.

You might have a point. But I think it’s moot because the overwhelming majority of wronged customers won’t or can’t put up a stink on Hacker News or equivalent. So the difference is a sliver.

PayPal let’s you manage your subscriptions on your end iirc.

Yep, is a screen in their consumer-site that shows all active billing plans. Two clicks to cancel. And that page is easier to find now (was buried before)

Yup. It's so obviously better for the consumer (and reduction of consumer support burden) that it's unbelievable that Stripe, or credit cards for that matter, don't have it.

For Stripe to offer that they would have to expose a "Stripe account" for buyers (the same thing the linked article complains about PayPal doing). For cards to do that they would have to move to only accepting merchant specific tokens you can revoke individually instead of the current state where the merchant (or their processor) has your card number.

Always takes a while to find that page though - why can't your active subscriptions not be on the page when you log in...

They still have no API to allow me (as a seller) to check the status of a given subscription. Unbelievable.

Assuming the thread gets enough upvotes to be noticed, anyway. That could mean posting at the right time of day, on the right day of the week, following another related story that helps drive more readers to check it out.

While it’s a fair point that with PayPal, you are almost entirely SOL, whereas with Stripe you at least have a chance, it’s not a tenable solution.

With thousands of employees you’re bound to get some (say 5-10%!) which are outright bad at their job or malicious.

The fact the founders quickly offered assistance directly, when they’re business is worth tens of billions is at least worth giving the benefit of the doubt. Even if it’s just for PR, they’re at least doing it.

> Even if it’s just for PR, they’re at least doing it.

Why the hell would you praise a company for an empty gesture? You're defending bullshit like it's a good thing.

I never suggested they were doing an empty gesture.

I’m assuming they’ll fix the problem, even if it’s just for PR purposes.

You should read more of the comments, including at least one that explicitly states how a founder reached out on HN only to never reply via email. It's been documented as an empty gesture, aka bullshit.

Anyway I misread your previous comment, sorry about that.

Just to play devil's advocate... It can be hard to know that there's a problem if it doesn't get escalated to the right people.

I'm sure most devs have an experience where something is broken for weeks before you happen to overhear someone talking about the multi-step workaround for a 5 minute code fix.

I think the same kind of issue applies.. Support teams are encouraged to not escalate, if they do, it often goes to a higher level support (but not any developers/business people). They find a clever solution and that becomes the common practice. It's not until a big stink is made that the right people are aware of a possible problem, and perhaps only then investigate the scope of that problem, and realize it needs prioritization.

Of course, this doesn't answer why the support team didn't even read the email to see you're not asking for a password reset... But might be a contributing factor.

Real world example: Mastodon would toss out and stop updating home feeds to save resources after a period of inactivity.

https://github.com/mastodon/mastodon/issues/5634

So people came back to empty timelines. Terrible UX, but until someone both experienced it and mentioned it, no one with code access realized how bad this was for returning users. Now there's a friendly message letting returning users know what's going on.

I once found out that an admin person was spending a couple minutes many times a day to open a user profile, find half a dozen different fields and copy them into a word doc template and then printing to a pdf that she emailed to the user. I added a button “generate pdf” for her and she was thrilled.

Put simply, it shouldn't. I'll help fix this when you have a chance to forward on. (We stop recurring payments when a business closes their Stripe account, which looks to not have been the case here.)

Assuming user has issued chargebacks 7-months back to back — why would this not be a signal Stripe needs to understand why and not keep charging the customer; one would think even one charge back from a vendor for a specific customer subscription would require re-authorization by the customer being charged prior to Stripe sending another charge.

What am I missing?

If they closed their Stripe account I wouldn't be here ;)

The problem is they decided to leave up their Stripe account and just stop replying.

Following up here, do let me know if I can help. I haven't received anything to the email address, let me know if there's another way to help get in touch.

Hi Sam from Stripe, how about having a Stripe internal meeting about how Stripe support shouldn‘t consist of "X from Stripe here." HN posts? Are you aware "X from Stripe here." has become a HN meme?

There are third party solutions to fraud that actually work, providing chargeback insurance.

Essentially, they screen transactions; if any approved transactions are chargebacked, they refund you.

A good start point is https://signifyd.com

We dropped in this solution on our e-commerce about 5 years ago; fraud has been a non existent problem.

You can contact AMEX to block the vendor from any further charges. Can you not ?

I've done that 4 times, AMEX has a block (multiple blocks as per the reps). But the charges still go through (that's another story).

The AMEX people just keep saying Stripe has a "iron clad contract" so even with that, they cannot do much.

I am not saying it is a 100% Stripe. But why would a company like Stripe allow me to do (successfully) 7 chargebacks in a row. At what point would an account be shut down or a subscription terminated? If this was PayPal, the account would have been frozen ages ago.

Can you not report your card as stolen, get your bank to issue you a new one, and be done with it?

I've got a brand new card number, CVC, etc. They can still charge it because the subscription contract exists, there is nothing AMEX can do.

Even with a brand new credit card, reported as stolen, what ever. If a monthly subscription contract exists (which you sign once you click that button to pay $5 monthly I guess), they can continue charging the account.

This was what AMEX rep told me.

It’s pretty surprising that credit card companies will route charges to the particular “account” linked with a “number” even if the “number” is “closed” or “cancelled” or “expired”. Certainly not the experience one intuitively expects up front. I realized this when the bank issues me a new card proactively due to a data breach, but old recurring charges still work.

I guess this is both for customer convenience and to give the bank more flexibility, but I think this would be a lot simpler if closed credit card numbers just stopped working.

If anyone is interested in how this works:

https://stripe.com/docs/saving-cards#automatic-card-updates

> Stripe works with card networks and automatically attempts to update saved card details whenever a customer receives a new card (for example, replacing an expired card or one that was reported lost or stolen).

> It is widely supported in the United States, allowing Stripe to automatically update most American Express, Visa, Mastercard, and Discover cards issued there.

Google did this to me with GCS: they automatically updated my expiring credit card. It's not a terrible feature, but I think users should consent to it before companies do it.

They probably do. Remember the terms and conditions that we didn’t read?

Okay. So I can steal an AMEX card (in fact, copy the numbers so that the cardholder is not aware), subscribe it to a bunch of leeching services, and expect that those subscriptions will go on and on even if the holder finds out and changes the card details?

My god.

It doesn’t quite work like that in Europe, as far as I know. The fact that you file chargebacks over and over and they don’t do shit is even more insane.

> It doesn’t quite work like that in Europe

Which is annoying in its own way because when your card expire, you need to manually re-enter its new details into all the services you're using. And you (or at least I) will inevitably forget one of these until you need it urgently.

Looks less annoying to me than not being able to cancel.

Although in the US people still subscribe to "newspapers" where you can subscribe online but have to wait for hours on hold on a hotline to end the subscription...

Not annoying to me either, I do it every two or so years to clean house of unnecessary subscriptions.

I would get super annoyed at the US behaviour.

Not annoying at all. It's a good opportunity to revisit each subscription and check if it's actually useful.

You can try contacting your ombudsman, official notice is less likely to get the circular finger-pointing game

Some stripe folks are very active on HN. May be they can help ?

Do you have suggestions for replacements for Stripe Connect for marketplace usage? The combination of being able to calculate fees and cuts before you tell Stripe to pay it out to partners through Stripe Connect seems pretty unique.

There are several other Merchant of Record alternatives, but I have not found something that can do quite the programmatic approach you can with Stripe.

Airwallex is pretty good and it can replace both Stripe and Connect.

I am a customer of their banking service and I played with their APIs. It feels like Stripe at the beginning, hopefully they'll be good for this decade

Braintree has a similar product. But they were bought by PayPal several years ago, so you are getting into that mess of a company.

For whatever it’s worth, in your specific scenario, Amex can usually place a merchant block on that specific seller to prevent them from ever charging you again — I know they can for the New York Times, anyways. (I recognize this does not offer value to the Stripe conversation, but still.)

Cant you just cancel the card and get a new one?

It's not a guarantee - card networks have a system where they will send payment processors the new card details, so the fraudulent charges will recur.

As far as I know, it's not granular, per-merchant, so you can't skip the fraudulent merchant while updating the legitimate ones.

Furthermore, some banks may not even give control to the user about whether this happens or not.

Yeah but such a horrible solution. After the pain of reporting it and getting it changed, now you get to update a dozen or more auto-pay accounts. You're sure to miss at least one and have something (probably important like your internet or phone bill) cut off on you at the worst possible time. Plus you get to spend days without usable plastic. Hope you have a spare card or cash.

Would much prefer a solution simpler/easier/less devstating than dropping Mjölnir on it.

That's what I do once in a while... it works.

I wonder if this counts as a case of wire fraud.

Reply on news.ycombinator.com