I hate Stripe, so I'm going to build my own payment processor | Hacker News Reader

I hate Stripe, so I'm going to build my own payment processor

old.reddit.com

91 pointslopkeny12ko79 comments

Stripe used to have really simple docs: paste in some js, paste in some example code on the backend, and you’re good to go.

Now it’s really really confusing. Payment intents are confusing. Figuring out which part of the docs I need is confusing. Figuring out the limitations of the self hosted checkout pages is confusing. The pricing is confusing. There’s narrative for one-click checkout that is comparable to PayPal (I guess there is “link” but seems like a separate thing?)

Give me a thing I can copy and paste. Give me a hosted subscription management page.

Finding a way to allow legal businesses to operate would be huge, though my impression is that you get yanked around by banks a lot.

Don’t nickle and dime me on features. Make it easy to get reports out.

Although I agree with all the issues you raise, I think the confusing nature of the pricing is by design.

Stripe's fee model probably makes serious bank, because it's quite non-transparent and basically nothing is provided for free. Want even the slightest extra feature? +1% of your revenue (and repeat)

Ah, the "we're out of ideas and have nothing, time to squeeze until the company dies, to chase stock price" phase of a business.

Like your cable company!

It's worked for 45+ years for cable companies.

Negotiating for medium and high volume sales isn’t exactly unheard of…

It’s kind of the rule rather than the exception in B2B. Hell, a lot of businesses will give you better terms just for opening a business account.

Yeah well, this article is called “I hate Stripe.” People hate Comcast too.

> Stripe's fee model probably makes serious bank, because it's quite non-transparent and basically nothing is provided for free.

Whatever it is making, it is apparently not enough to IPO. I would temper my expectations.

I’d say it’s not enough to satisfy early investors, who probably want a 10~50x return before IPO. They could definitely go public if they wanted to, and do ‘well’.

Does Stripe need to IPO? Are they just privately held, or do they have VCs or others that need to be paid back?

They have raised at least $6.5 Billion.

You can make plenty of money and still be private. Look at Steam.

Stripe ['s leadership] doesn't want to IPO, and its balance sheet doesn't need to. There's ridiculous demand for a Stripe IPO, whether it could is not at all in question.

An IPO is, if anything, a bad thing for a company. I wouldn't consider it a black mark that they aren't selling stock publicly and subjecting themselves to the "must grow every quarter at all costs" insanity.

It's worth noting that most customers with any volume will be on custom contracts that will either be cheaper, include more features, or both. At my previous workplace we had this with relatively modest revenue and would renegotiate every year or two.

Is there a process for getting an account manager with Stripe? I think it would be useful for other reasons but cheaper fees is certainly good too.

I'd do like that:

- Have a large enough transaction volume, say, above $100k / mo.

- Use the contact form.

Note that if your transaction volume is $100k/mo, and Stripe takes 3% of it, it's $3k/mo for them. Maybe a customer that's worth paying extra attention to, but of course by spending a minimal amount of time.

I suspect that if your transaction volume were, say, $1M/mo, they would have contacted you already.

There's a "Contact Sales" link right next to the sign-in button on stripe.com.

“Everyone gets cheaper pricing except anyone you know.”

Stripe is also one of the most expensive payment services - enough so that I worked at a company where we had an in-house payments frontend for Asia which was basically a common integration over about 6 different major regional banks. The reason was pretty obvious: Stripe was something like a 2.5% surcharge, our system 0.2-0.5%. That was a huge difference in revenue.

How did you get the visa and mastercard interchange fees down so low? Just the interchange fees for non debit cards can be as high as 2.5% (premium travel cards for example), not even mentioning Stripe's fee then.

AFAIK it was basically just minimising Stripes cut so overall the cost may have been higher then that.

Stripe has both hosted checkout and subscription management pages.

I'm one of the founders of OpenPay (getopenpay.com) and we support all this functionality and have a simple to use API. We are charging way less than Stripe so you don't have to pay the "Stripe tax" just to run your business

You can also bring in whichever payment processor you want which will help you save on your payment processing fees

FYI there’s a typo in one of your image assets below the fold on your landing page - under the subscription optimization tab, the failed payment, recovered payment mockup says “paymet” rather than “payment”.

Product looks cool in any case.

Thank you- will fix. Feel free to reach out to us if you'd like to give it a try

That sounds great, but with the "pricing" link on your site going to a "contact us" form, it's hard to be convinced of that :-(

agreed, would love some transparency on the pricing page

Isn't it just the reality of payment today ?

If you're not letting them do the checkout from start to end with only theme changes to the hosted payment page, you're signing up yourself to learn the different flavours of payment auth, callbacks and state management.

No! Stripe docs totally suck today. They're a labyrinth of things that do not impact my business that Stripe decided need to occupy my limited time.

I just want to take payments for dead-simple SaaS. I don't care about the 20,000 use cases for different billing product lifecycles, itemizations, etc.

"Launching a startup? Do this: [x]" would be incredible.

It's wild that Stripe doesn't have the 99% case covered.

The real reason for this is probably because Stripe's main customer isn't the scrappy upstart anymore, but rather the giants up-market. We're table scraps now.

Is this not exactly what you are looking for?

https://docs.stripe.com/checkout/quickstart

But that's deceptive and not all you need. You wind up having to learn about all of the lifecycle and state machine pieces anyway.

The API surface area is large and cluttered with stuff that's entirely irrelevant to most business types, yet you have to understand which parts of the API, checkout session, and webhook callback payloads are relevant and mutate your subscription state.

> I just want to take payments for dead-simple SaaS

You'd be paying for the prepackaged all hosted and standardized offering (at the higher price point) if all you wanted was to "just" take payments.

I assume you actually want recurring payments, potentially lower fees and a personalized checkout experience ?

Welcome anyway, I've been playing with payments systems for a long time and there's no shortage of fun and new regulatory spice coming in every now and then. "Just" taking payments can be a whole way of life.

I wholeheartedly disagree. I think the Stripe docs and developer experience is one of the greatest, if not the greatest, I've ever seen.

It has great user docs, API docs, developer centric UI elements like copy pastable IDs, webhook event browser, time travel features, test mode (!!), and you can even look at the exact API calls that the stripe UI itself is making. I've brought it up to many colleagues are awesome the docs and experience is...

IMHO, for most things, the data model is straight forward and well explained. Of course there are complicated topics and quirks, but that's just because payments is not easy in general..

I'm clearly a Stripe fanboy, but I am not affiliated in any way.

Stripe undoubtly has great docs. The problem is:

- Them adding a ton of products that are automatically integrated/opted-in their default payments stack

- This has massively increases the api surface, and the complexity of integrating stripe has gone up.

- And to top it off, they charge for every single "feature" that they automatically added in their payments stack.

I agree. I think stripe is complicated because accepting payments is complicated. It’s easy to start a new services that only support the 80% of use cases. Especially if you don’t have to consider fraud or regulatory requirements. But that remaining 20% is what kills your simplicity.

They seem against any nay-sayers, so I’ll respect that and bite my tongue.

The silver lining is that, their idea (which they later reveal that they “forgot to mention” will also include full banking support and the issuance of cards) is very complicated and will require years of non-stop planning and paperwork before a single customer can be onboarded.

This isn’t handing your friend the keys to a jet and letting them fly a plane, this is your friend wanting to enroll in pilot school. It’s good to try, and, if you realize it’s not for you, there’s nobody harmed as a result.

I'm one of the founders of OpenPay (getopenpay.com) and we offer comprehensive subscription management and analytics, and our customers can bring in any payment processor they want. We don't lock people into only using one payment processor like Stripe so we support a lot of businesses that have gotten banned from Stripe

Would love to partner together to support all the subscription + hosted pages + analytics functionality

They don't say why the hate Stripe, but presumably Stripe closed their account for fraud/spam/PBL reasons and took "their" money and won't give it to them. Whether or not this person/team succeeds, the real point is that spite is a powerful motivator. We all find motivation, in our own places, in our own ways, and spite is up there.

Yeah, you nailed it. They claim that their Japanese online Coffee shop was hit by a BIN attack and strip wouldn't let them back in, but didn't exactly give any details

https://old.reddit.com/r/SaaS/comments/1f762xf/i_hate_stripe...

I didn't know what BIN attack was until now but it seems to be essentially brute forcing card details until one succeeds. How is that even feasible and why would the sellers account be banned in the case someone got the right combo? Very strange and suspicious.

A BIN attack is feasible if the entry point lets you endlessly try card info. There's not that many, and issuers will give leeway on the card details (some won't care if the card holder's name is botched or completely wrong for instance)

That's also why a PSP will ban the seller if they let that happen on their payment page.

> A BIN attack is feasible if the entry point lets you endlessly try card info

Yeah, I just figured with all these fraud detection systems in place that rate limiting would be figured out and implemented. Regardless if the seller has a custom page or not, I still would think that PSP APIs would inherently disallow this to protect their customers.

The complicating factor is that every business is different, and there are legitimate cases where an influx of random card just happens, or a slow trickle of payments goes on at a steady pace.

In particular the PSP usually have no window on the seller's system (the seller handles the client and transparently passes the info to the PSP, contractually promising it won't peek into it). So they can't decide on their own if a set of payment requests come from a single end user or multiple ones.

There usually will be additional services and hooks to protect from these issues, but with additional fees attached to it, and a bit of dev to do on the seller side. Which means some smaller shops will forgo them and get bitten.

Good luck to them, but this is the "reason" crypto exists. I don't think we need (or can sustain) dozens of payment processors all with their own flavor of politics/dispute resolution quirks.

Crypto is going no where, as an end user payment option, until consumers can do chargebacks.

There are ways to solve this, but they involve gatekeeping, which of course puts us back at step one.

I'm not sure this is a convincing take on crypto. At the end of the day, you still need an on ramp and off ramp to deal in it, regardless of whether that's a bank or some other third party. We've already seen multiple times that e.g. certain blockchain assets are blacklisted. If you ever tried to move or cash them, the most likely outcome is a SWAT team at your door once there's a link to your name, similarly any financial institutions or corporations mediating it would face severe punishment. So effectively those assets are fenced off, no one wants the risk, and the end result is not different from regular finance.

Crypto as in:

- Decentralized finance (not even Coinbase)

- Decentralized internet (everyone has servers)

- New currencies / economies (niche-specific wealth)

- Stop macro exploitation of intl economies

- Information available to all

- Sanity restored to money system / no more theft

- Sanity restored to content / no more censorship

Then sign me up! Or actually don't... I'll sign me up!

Crypto as in:

- Centralized exchanges

- Centralized content hubs and "vaults"

- Crypto twitter celeb ICOs and pump/dumps - NFTs ZKPs PePes and emojis

- More corruption than ever

- More theft than ever

- Information obfuscated by memes and schemes

Then no thanks, I'm good. Crypto was cool in the beginning, just got steered into a mess that nobody wants anything to do with anymore (probably intentionally).

FWIW people are still building in the former list and never stopped. It's the "degen" speculators that got loud enough to overtake the public-facing narratives for their own personal gain.

Fair take. I always thought it was weird to have crypto projects in Discord servers. The dream was corrupted.

Apart from the myriad technical reasons that existing crypto transactions will never be a replacement for existing payment processors, I'm personally not interested in a payment system that makes all of my transactions a matter of public record.

The uncomfortable truth is that the vast majority of consumers, both in terms of quantity and amount of money owned, would rather have a bank be liable when something goes wrong instead of being liable themselves.

Crypto is very much like gold. When it gets stolen, either due to your account getting hacked, your bank's account getting hacked, you being phished, you buying a phone and actually receiving a brick, or even your employee transferring all the money your company has and fleeing to China, there's no recourse.

That's not how traditional finance works. Most financial transactions are, to some degree, reversible, and many of those that aren't will be refunded by the bank / insurance / government in case of fraud. This is something that most banking customers want.

And if you want irreversible, like gold/cash, you can always use Zelle which is supported by most banks in USA

There is no legal supported way to take Zelle payments as a merchant. And it has strict limits on transactions.

If they think the response from Stripe for fraud/spam/PBL was too harsh, wait until they see how their banking partners (Deutsche+Fargo) will handle that; if they can't even keep up a level of due diligence that's "clean" enough for Stripe, they'll eventually end up owing the whole company to the banks due to contractual penalties and cost of fraud.

A big reason why companies use an outsourced card payment service instead of going directly for a merchant account with banks is the difficulty of handling fraud & spam well, which is horribly expensive unless you have got a major economy of scale.

As a payment processor, your potential risk is larger than your turnover. And while Stripe might freeze part of your incoming funds, in this business you'll need significant upfront capital as collateral - which you'll lose if you're mediocre at handling fraud.

This is kinda a broad topic, but I'm kinda uncomfortable about the fact I still don't really understand how all this payments stuff works. Can somebody enlighten me, what does it take, exactly, to build a payment processor? Can anybody do that, theoretically? Do you have to implement some payments API for every bank your customers will use? In every country? I assume, the API's are not entirely open and are more than just a number of SWIFT conventions, so why would the banks work with you, how would you convince them? What really is a payment system, anyway, what's the difference between using a card and making a bank transfer? Why are there so few credit card providers, how are they different from, well, your future payment system?

There are many questions beyond that, but it should be enough to judge the level of my ignorance. So, maybe somebody knows a book, a set of good blogposts, a really long YouTube video? Something?

I think patio11’s blog is exactly what you’re looking for. Probably scroll back to the earlier posts to find more fundamental stuff like what you’re asking:

https://www.bitsaboutmoney.com/archive/

seven years from now, this person will have become everything they hate about current payment processing methods.

If they are successful and its a big 'IF'.

Didn’t the creator of stripe have it written in like, a few months? Iirc, he spent years dealing with regulations, not tech issues.

Yep, you could write your own Stripe in a weekend - the pain is regulatory hurdles.

They posted that on reddit. How far do you think they can go?

People post all kinds of things on reddit. Most of them aren't true at all.

Most people who post on reddit are people no one would listen to otherwise. That's why they post on reddit cause reddit will let anyone post there.

I posted this because I passed regulatory requirements through partner banks and institutions. Reddit is Reddit; that’s what I realized they are just limited.

These days, it's probably easier to obtain a share of big tech profits by engaging in government regulatory shenanigans than to compete against big tech and 'earn' the same amount of money 'on the free market'.

If I was OP, I would just try to get a job as a financial regulator and create more regulations in exchange for a cushy job after.

I work in this space. Good luck! It’s extremely difficult and can be expensive getting off the ground (in addition to high CAC) BUT it’s doable. Buckle up!

I like this attitude, and I wish there was more of it.

We should not grow fear to take on challenges, but support and cheer on those who go head on even if it is the most steepest climb.

Most attempts will end in failure but that is fine, it is not the end of the world. Get back up, brush off the dust, enjoy the experience and knowledge you gained from it then get going again.

In case they need to figure out what exactly they need to do: https://news.ycombinator.com/item?id=30650828

I can't wait to hear the fallout from their first PCI audit; "what the f** is a tamper proof bag?", "Key ceremony? No, sorry I'm not religious"

But seriously I wish them luck, and I sincerely hope they know what they're getting themselves into and are receiving good advice/support from SME's.

EDIT: Ok I retract that statement of goodwill, OP in that thread just comes across as a jerk. Enjoy the audits.

How many "Stripe problems" are really financial systems problems just being passed through to the user?

I like the Indian system: no protections, just direct bank-to-bank transfers.

One must imagine Sisyphus happy.

how so?

Regression pulls things towards the same point after a long enough time, like gravity pulling a boulder from the top of the mountain to the bottom. Resisting that regression, although pointless, has to be enticing enough or else you would simply give up. So Sisyphus had to have a positive or satisfied mindset to see the meaningless result of his actions and repeat it.

neat

That guy can't even remove tracking from his posted link, how is he even remotely going to build anything blah blah

Good lord. The god nitpick.

I don't want to remove anything from my link; I don't care if it's with tracking or without. So, if you want to remove tracking, just right-click on the link, and you'll see 'Copy Link Without site tracking.'

If they are going through the bank then they are not a true payment processor but a payfac. To be a processor they need direct link to the card networks like visa, amex,MC, etc. It's a tough space that requires solid domain knowledge to be profitable and not eaten alive by fraudsters.

I actually have the code written for my own payment processor (including crypto)--that's the easy part. The hard part is the money transmitter license fees, which are insane and make it impossible to bootstrap.

I posted this yesterday: Reddit really hates VPNs, in my opinion, so my Reddit account got banned.

Imagine building and owning the platform, but not being in control of it. That is what Stripe has become.

The only way to get Stripe Express to stop emailing you during an incomplete registration with a third party, is to change your email address. I used root@127.0.0.1 in the hopes that it fills up a disk somewhere.

This is the response to my support requests...

-----------------------------------------------------

We want to express our sincere apologies if we were not able to respond to your email on time and I understand how important it is to get it resolved for you.

Jumping right in, I would like to inform you that, as you have a Stripe Express account, which is being controlled and managed by the platform (XXXX Inc.) and we do not have any control over it. Also, the only option to delete your account is with the help of API, which can only be done by your platform.

For context, with Express accounts, the platform has the ability to specify charge types and set the connected account's payout settings programmatically. The platform is responsible for handling payments, disputes, charges, account deletion, payouts and refunds.

However, as you mentioned that you're not getting any response from your platform, the other option to stop receiving email is by changing the email address on the account, which I am able to see, you have already changed it.

-----------------------------------------------------

Reply on news.ycombinator.com