I won't pay on your website
github.com
github.com
My phone number starts with +49 and is longer than a North American phone number. This prevents me from renting a Bixi bicycle in Montreal. You know who likes to rent bicycles? Tourists like me.
In any case my card failed with a generic error, both at the payment booth, and in the mobile app (after working one time).
Another one was a stand up paddling booking website. I shouldn’t need a Canadian postal code to rent something (especially 10km from the border) yet here we are. In any case it was impossible to select the field on my phone, so I dropped out. I wonder how much business they lost to this single bug.
This sort of stuff happens when you ask for data that you don’t need, and validate it beyond your needs. I fight tooth and nail with colleagues to reduce the size of forms to avoid this sort of friction and bugs.
EDIT: oh and IBAN discrimination, which is illegal but happens even on government websites
I live in Vietnam and my address looks something like
561/34/13 Điện Biên Phủ, Phương 25, Quận Tân Bình, TP. Hồ Chí Minh
The ways this usually fails with websites:
They tell me a slash isn't allowed, like they know my address better than me.
They tell me I need a post code. There are no post codes in Vietnam.
They tell me I need a state or province. Hồ Chí Minh City is a city without a province. (There are five such cities that have the same rank as a province and thus aren't contained within one.)
They have no concept of phương ("ward") and quận ("district"), without which the rest of my address is anything from ambiguous to useless. They often have a "second address line" where I can put this in but they often have limitations that make it impossible to enter. (Like not allowing commas, or only allowing 15 characters, or not allowing periods, and I don't even remember what all problems I run into the years with it.)
And all for what?
eg: https://en.wikipedia.org/wiki/Passport#/media/File:ROC_Natio...
I set postal code to 700000 for HCMC (in theory, we have postal codes defined in VN. We just don't use them).
Usually I set province = Hồ Chí Minh City and then am able to select city = Hồ Chí Minh City as well (even though this is incorrect, as you say).
The lack of slashes is still often a show-stopper for me too, as is insufficient space in the address field. I live not that far from 1806/127/2/6/15/48/2P Huỳnh Tấn Phát, which I imagine delivery drivers just love.
Even with all the tricks, I've occasionally been unable to pay for services online, and had to find alternatives. Sometimes I'll also see Vietnam, Viet Nam and Việt Nam as separate options on a country selector. When importing something expensive from overseas, this does not exactly fill me with confidence.
I also use 700000 for HCMC even though that isn't actually accurate for anything except the main post office in District 1. You can actually put in any number since no website does anything with it. Which you sometimes have to do when they tell you that "700000 is too long for a post code, must be 5 digits or less".
AFAIK the "accurate" post codes for Vietnam (that no one ever uses) are:
https://phaata.com/thi-truong-logistics/zip-code-hcm-ho-chi-...
Common in London, too -- even on British websites. They'll require a city and a county, at which point I need to enter "London" for both. Things will still be delivered correctly, fortunately.
Even when using it for shipping, what I do is to repeat information. They want a "province"? I have no idea what this is (I am French) so I repeat the name of the city, or I put a region. When the letter/package Congress to France the address won't be correctly formatted anyway so they will do a best match - and it always worked without problems.
Sale for phone numbers. I usually try 0000000000 which often get rejected, and then 010101010101 which usually is accepted (sorry for the prob who uses this number in the Paris region).
Personally, I think a correct response is "Hey man, you wanted to sell things on the World Wide Web. If you want to exclude Vietnam, Main Street has storefronts for you to rent"
I absolutely hate it when you try to give a company some money, and they just fail to close the sale!
They try to make some localization and validation and fail greatly with that.
The province doesn't matter in German addresses at all. But when entering the ZIP code it always presented me the city as the main city in the province, which is not my city. My city is 20km away.
At the end I put everything again into the second address field, which allowed some free form input.
...wait for it...
... an AI-powered address validation system, offered by some random local startup. That validation system tried to provide autocomplete and attempted to automatically segment the address in a seemingly free-form field, but something in the integration got botched, and it wasn't able to identify house numbers - and without identifying one, it would not let the check-out process to continue.
I've actually tracked down the startup making this "address validator" (who in the right mind funded them, and why companies pay for this, is beyond me); they had a demo form on the landing page, and it correctly segmented my address - which is why I know it's the integration with the particular seller that got botched. Nevertheless, I'm still in shock - why on Earth would someone do this in the first place? It's strictly worse than having multiple fields - name, street, address part 2, zip code, city, etc. Multiple fields are already bad for reasons discussed in this thread, but a single free-form field that's parsed by "AI" into colored segments as you type? What in the fuck.
And from the company owner's point of view: Imagine spending extra money on development that stops users from completing a purchase.
These cases are the perfect answer to "Why do we need senior developers on our team who have good judgment?" This is why--to prevent software like this from even being written in the first place.
Hanoi post code is in the 100000 range (used to be 10000), Saigon's 700000
But a decent number of them appear to switch off most/all validation once you select a non-US address, which I think is a perfectly acceptable thing to do. (That's if they even support a non-US address, that is.) I've never seen any data but I wonder how much help validating addresses even is.
The "must have a postal code" is by far the biggest problem. I can't recall a website that actually can cope with not having a postal code.
In practice you can put in any number and the local postal delivery here will ignore it/figure it out since it won't be the first time a foreigner has put the wrong address on something in Vietnam.
Wonder how many misdeliveries these features cause? Both my and GP's annoyances can be solved simply by leaving the entered data unmangled. I've supplied precisely what needs to go on the packaging to get the item to me. All of the text is necessary, sufficient and in the correct order. Don't change those things. You don't know better.
Want to know why I bothered to try and get it fixed all this time? Because this little mistake made it nearly impossible to order food via any of the food order services. Uber Eats, Glovo, Pyszne.pl, etc., in their infinite tech startup wisdom, all integrated with Google API to fetch postal codes based on address, and use them to filter out restaurants that can deliver to the user's location. With my address mistakenly mapping to a village 20+ kilometers outside of Kraków, do you care to guess how many options I had to order from?
That, plus it also messed up ordering taxis via FreeNow and Bolt, which also integrate with Google API for stupid reasons. This also means the drivers need to use separate apps to navigate around the center, because Google doesn't have data on which roads are banned for traffic except buses and taxis, and the parent companies are too cheap to license from a provider that has this data. All while in the apps themselves, if your route starts, ends, or even crosses anywhere near the city center, the estimated time data shoots up to some ridiculous values, while the map gets entirely confused, as Google Maps integration is adamant that the route we're on is physically impossible.
Recently been to China, and now that everything requires WeChat, it's extremely convenient if you're local, but as a tourist things are very difficult when you don't have:
- a Chinese phone number;
- a WeChat account with payment activated;
- a Chinese ID card.
Wanna read the menu? Only if you have wechat and an internet connection to scan that QR code (many places have no physical menus).
Wanna pay with cash you've just exchanged at the airport? Sorry, nobody uses cash anymore (many shops won't accept cash at all).
Wanna book a train ticket online before you reach China to plan your trip? Sorry, you've got to be Chinese for that and have a local number.
Wanna pay with your credit card something in a big mall? They might accept it, but their IT system might not always manage to communicate with your bank and it may fail for no reason.
Albeit, the opposite problem is true in Germany: many places only accept cash, or only accept EC cards, aka special credit cards issued by German banks only.
I hate this trend so much
* Don't need to purchase paper.
* Don't need to purchase or contract a printer.
* Can change the menu willy nilly.
* It's in line with the current environmentalism fad.
But that said: If the restaurant can't be arsed to provide me with requisite-free information on what god damn food they serve, I can't be arsed to provide my god damn money for their time.
On the other hand, I do glean some amusement that the region where cash was invented, no longer accepts cash.
Once I hit this with zip code validation. Knowing that the credit card processor doesn't actually check this, I found a particular state (Arkansas) that happened to include my Polish postal code. This worked and I paid my bill.
Strangely, no one pointed out the obviously fake email address or phone number when I had the breakfast. Perhaps it wasn't needed after all.
The funny thing is that they can't actually validate the email address so most just accept whatever (sometimes with a small extra filter to avoid stuff like a@a.com).
he thought it was based on Metal Gear Solid's reference to the Watergate thing. Didn't get the other connotations -- at least not at first. He disowned it, and we laughed about it for a while.
I still use that email for anything that requires an email but I DGAF about. Hasn't been rejected yet...
While I suspect this is a screwup on the part of Bixi, you're making the mistake of confusing bikeshare with bike rental. Don't worry though, you're in good company, including many companies that operate bikeshare.
Bikeshare is meant to be a transportation service to get people from point A to point B. More often than not tourists don't use it that way and even when they do, they would be better served using bikes that are not part of the bikeshare system so they're able to go slower than a commuter would and enjoy the sights on the way, as well as stop randomly to checkout something that might look interesting.
Tourists are almost always better off renting a bike for a day or even a few hours than using the bikeshare system.
Many bikeshare systems would in fact be better served restricting access only to long term members.
Getting and returning bikes at dedicated rental shops is quite a hassel, typically much more expensive, and unnecessary if I just want a simple city bike.
In fact I suspect that it's often intentional that tourists have a hard times registering for bike share systems. They would greatly impact the business of preexisting bike rental shops.
It's always been super handy for when friends come to visit and we can all take the same method of transportation, and it means they can afford to park further out of town where the free car spaces are and cycle into the city centre.
But the best secondary effect was that it locks out foreign banks who can't be arsed to set up a local branch and apply for a banking license.
How often do you read on Dutch forums [1] whether they paid with iDeal? Because if you do, your only recourse is to either sue them (which the Dutch rarely do) or open a dispute with the Thuiswinkel Waarborg [2].
For as long as I bought stuff online in The Netherlands I used a credit card. If they didn't offer it I'd find someone else.
[1] https://tweakers.net (tweaking as in tinkering, not the other kind)
Some app, don't recall which, would not accept my Argentinean phone number.
I now want to try Cargaroo or something like that, but I am not willing to give them my CC information and they don't have paypal.
Eventually I gave up with that site, and tried the same booking on a different website. It immediately said "Your bank has declined the transaction. Either you have insufficient funds in your account, or the transaction is above the bank's limit for this card." Annoying, but checking on the bank's website revealed there was an unspecified limit. The first site would have got the sale (with a different card) if they'd given me a clear error message.
The ones that really seem to think about the payment experience are the ones that have low to medium average ticket size and high transaction volumes. It is in the website's best interest to ensure each and every transaction goes through
I also figure you haven't worked in the field because otherwise you'd know the site isn't necessarily in charge of what error codes the card handler is giving.
Although of course the site will be in charge of turning the not necessarily perfectly documented codes and which may vary based on a great number of different factors into error messages.
Which may well be the case, or it may be that whatever third party handler they are using to take care of transactions does a bad job in returning this kind of error message.
Or it may be that there is heightened security about the site right when you are using it and it turns out that in some opaque process the site has no control over the credit card handler is now returning less informative messages for that site and it is the same handler on the site where it does give a good error back.
etc. etc.
Which is, admittedly, a very HN assumption to make on basically any subject that comes up.
No, it's your assumption that is wrong! You gave an explanation of several possible reasons, and you assume that people care. Actually, they don't!
The first site worked crappy and the second worked nice: the first site missed the money and the second one got it!
Whether OP actually worked in e-commerce is kind of irrelevant. I've never worked in e-commerce either, and if CompanyX fails to process my payment and I can't buy something from them, I'm going to rightfully blame CompanyX for that, not one of their service vendors.
But in the end, the effect is that they lost a sale to a competitor who got it right this time.
That said, a bikeshare should be able to help tourists / be low-effort. Otherwise I'll just uber.
If I see anything that even feels like a dark pattern, I will just refuse out of principle.
> • Not having dynamic error validations before someone goes ahead with the payment. It is as simple as using the Luhn algorithm to make some basic checks.
On the other hand, someone that does validation of their own is far more likely to accidentally filter out valid values. This used to be rather common on email addresses. (I’ve been using almost exclusively @chrismorgan.info addresses since about 2010, and had one rejected exactly once, from a regular expression that thought TLDs were only two or three characters long; I was able to use my skills to bypass the check, and the backend accepted it.) Nowadays, people normally just leave client side validation to whatever <input type="email"> does.
So, payment card numbers. I’ve only ever had a 16-digit one, but they can actually be 10–19 characters long, and some people are sure to have hard-coded maxlength=16 and/or minlength=16 (or equivalent JavaScript checks).
There are also those ridiculous things that insist on splitting the card number into multiple fields (four groups of four characters), but that’s generally just painful to work with rather than actually preventing you from using it.
Hah, I wish. SO MANY sites disallow the plus symbol in the email name (e.g. something+else@example.com).
This is a valid email. It should be accepted. Arrrgh.
If you own a Google domain (not for long unfortunetaly, but I hear cloud flare has the same service) you can define *@domain for free and any email sent to the domain ends in the inbox of your choosing. Unlimited adresses.
As for +, I have no idea if it’s being blocked on purpose or by accident, but that kind of thing serves a useful purpose for the recipient, not just being able to create multiple accounts easily: automatic labelling. (And if you’re trying to create multiple accounts, plus addressing is an awfully prosaic approach, and there are plenty of other viable techniques, e.g. mail forwarding services, disposable addresses, adding random dots if you’re using Gmail—abc@, a.bc@, a.b.c@ and ab.c@ all go to the same mailbox.)
let form_email: Option::<String> = /* ... */;
match form_email {
Some(email) if !email.is_empty() => {
// ... send email with validation link
},
_ => {
// report missing email
}
}
I hate dropdowns for the expiry date. Let me just enter 01 TAB 22, I don't want to click on dropdowns then scrolldown.
2. It's not always obvious if a dropdown is focused or not.
It's orthogonal, but focus doesn't always cycle in the obvious order of input fields with nothing in between.
As for the field, couldn't it be a text field with a small down arrow within for a dropdown option?
When inputting license keys in programs, and there were dashes in them, it was always fun encountering an auto-focus across split textfields where you didn't expect it, so you accidentally skipped a field and had to redo it.
So now the month is 2023.
More friction.
And to remind users about date layout, you can just put MM/YYYY or MM/YY as a placeholder. Of course, if you care about your users and want to go above and beyond, you can even support both MM/YY and MM/YYYY – it's not that hard!
I'm in Germany and order at a lot of specific sites, and while I don't like PayPal as a company or their fee structure, it's usually what keeps me sane. Most cases I don't have to enter anything, no need to create an account or even enter the delivery address. Doesn't get much more convenient than that.
The site is suboptimal, it's probably not a great company and I have no idea if they're charging me anything - but the one-tap purchase system just works, and that's all I need. There are other great options in Klarna and similar, but even they give me too many options to coax me into paying later so I inadvertently pay fees. PayPal literally just withdraws from whichever card has sufficient funds at the time, has worked exactly as stated for over a decade, so I really have no incentive to investigate alternatives (especially for sites where my PayPal is already setup, like Steam).
no alternative thou that manages adresses, confirmation and the actual transaction with one login/button
Countries with low consumer trust.
If it opens in a new window, it always seems to error out
You put data into a form of a random website you want to pay a small amount to. Data which enables everybody who has it to cause trouble. Trouble to you, trouble to your credit card company, trouble to other websites who get scammed with it.
Websites should simply give you a string like "visa:3498734219:$12.34" where "visa" is their payment processor, 349... is the invoice nr and $12.34 is the amount invoiced. Then you copy+paste that into the website of your payment solution and let it do the transaction.
And if you don't like copy+paste, you install some app so you can just point your phone at such an invoice and click pay. Or a browser plugin which detects those invoices and asks you "Pay this?".
The amount would just be a string like "whatever+whenever".
So you tell your payment provider that you authorize this merchant to pull whatever amount of money whenever they feel like.
And not give out a piece of data that authorizes anybody to pull whatever amount of money whenever they feel like.
The difference I propose is not about the modalities of the payments. Not about the merchant being able to change the price or you being able to request refunds.
It's about how the relationship between you, your payment provider and the merchant you want to buy from is initiated.
Currently you hand over some secret data to the merchant. Who then communicates with your payment provider.
Instead you should communicate directly with your payment provider. Never giving secret data to anybody.
That’s exactly how your proposed solution would have to work as well, if you want to support recurring payments or price adjustments. As soon as you allow the merchant to adjust pricing and/or interval, it opens the possibility for fraud. Because there is some way that the merchant needs to have to adjust these parameters. And if the merchant can do it, so can an attacker that takes over the merchants accounts. Like it would be the case with PayPal today.
(And by the way, that’s also how most of the credit card payments work today. Stripe for example does not allow the merchant to collect credit card information of the customer. Instead, the merchant embeds a Stripe web page into the checkout process which collects the credit card information. All the merchant gets is a token that allows them to collect money from the customer to their Stripe account. If an attacker were to obtain this token, all they could do would be to collect money to the merchants Stripe account. So they would have to also take over the merchants Stripe account to get paid out.
All in all, this is a quite secure system. The only problem is that people love to type in their credit card information on sketchy sites that just plain out steal them. With your suggestion, people will still send scammers money because after all, people are and will always be stupid. Just search for „crypto scam“ on Google and you’ll find plenty of examples of people actively sending money to scammers.)
Yeah, apple might be doing something a little anti-competitive here.
Customers would think about that if they are, for some reason, not enrolled in Apple Pay, but other methods were not supported.
Selecting a country and entering the post code to find out the shipping cost is slightly old-fashioned but works very well.
Once you start using something with a QR Code, it's much much better:
- WeChat Pay and co. (in China);
- PhonePe and co (in India);
You usually have 2 ways to pay with those systems (only systems I'm familiar with, others might be different):
- Merchand shows a QR Code; you scan it and enter the right amount manually. Merchand gets a confirmation.
- Merchand shows a QR Code; you scan it but the amount and details are all pre-filled and you just have to confirm.
In both cases, it's scan + click ok.
Now, if worldwide banks in the world were to have a way to send money to each other without fees and with a single standard, they could make it happen (one can hope).
In Netherlands, iDEAL comes close to UPI as well.
It seems to become a European standard: https://nltimes.nl/2023/04/25/dutch-payment-processor-ideal-...
The redirection flow is when you break from the flow of your website and use the processor’s hosted checkout page. It is worth putting in the extra effort to blend the payment page until the end of the checkout experience to not lose your customer’s flow of attention. PayPal one-click checkout button is an example of paypal’s SDK flow.
You actually don’t need the user to reach the final checkout page with all these icons and progressive disclosures for checking out with Paypal
If the object is a product, then the force is advertising.
How boring.
The orignal article is disguised advertising, advertising in the form of a "knowledgable criticism" of existing payment services.
May the force be with you even if the object isn't.
I definitely prefer being able to go through inputting my card details using the numpad and the tab key. Having to switch more often between keyboard and mouse adds one more step to the nightmare that is online payment. While it is just a preference though, I wouldn't go so far as to say a date dropdown automatically means bonus points.
Emphasis: Your
This is a rare example of the small fraction where it makes the title more click bait.
The experience of throwing money at them is so satisfying, I almost want to do it just for the rare feeling of zero friction.
If I do want to pay on your website, and it is not as low friction in comparison, I will be considering how much I really want to pay or if I should just give up.
Once I booked a flight online by credit card and the payment timed out (or rather stopped at a late stage without an error). Afterwards the website didn't tell me if the payment went through or not. I called the airline and my bank and neither one could tell me if the payment was successful or not. Both just told me to wait a week and then check again... this was only around 5 years ago.
In the end the payment did go through, however if it didn't, I am sure I would have lost that seat/ticket. Lots of wasted time and stress for nothing.
My first encounter with him was when I was selecting classes and asked a friend "Hey, do you know anything about (short version of his name)?" "Yeah, he's great. That's not really his name, though. That's just all that will fit in the schedule."
Though I'm not a huge fan of opening up a new window for payment, this turns out to be much easier for us, implementation-wise. Plus, the Stripe Payment Link UI is able to handle most of the errors and payment methods, add discount codes, etc.
I usually don't mind those because you can just Tab to them and start typing and it will select the item from the list (if you have guessed the format right, and the dropdowns are native or custom but properly implemented). But why would you ever want that instead of simple MM / YYYY field (or two fields, if you don't want to add masking)?
Also it's a bit lacking on the stateful side of things. For example, a lot of Amazon customers hit "save card details" and then bam, one click checkout forever; making optimisation in this area highly diminished. Similar story and even more true for vendors that support Apple Pay.
The amount of spying in the payments industry is vile enough.
All of my accounts come with that enabled by default and will ping my phone app, so stealing my card number isn't enough.
Card details + something I know + something I have.
I guess it's the same intention, why to not tell the user an email is already registered on your site. Could be used for personalized scam/fraud. However often you trade security for comfort.
Apple Pay in browser checkout is pretty great