I Lost $210 to a Stripe Dispute Despite Proof
zarar.dev
zarar.dev
They should sue the customer in small claims if it is fraudulent dispute.
That person defrauded you, sue them.
If you evidence is what you say it is, you will most likely win. End of story.
The mere fact that my bank and the merchant have different email addresses for me should not give me an unfair advantage in disputes with a merchant. The main protection the merchant has from me is the fact that I'm too honest to fraudulently start this kind of dispute, which is not something a merchant should rely on for their customer base at large.
Bank of America's policy is inappropriately merchant-hostile here, and so is Stripe's policy of so blindly deferring to the bank.
That said, I'm not truly sure what the right fix is. Names are not globally unique or authenticated, and a fraudster with the necessary credit card information could easily have gone to the website and made the ticket purchase just as easily as the genuine client, even in the example of the linked article. And the last time I used my credit card (legitimately) to buy flight tickets for relatives to visit my wife and me, the only email address I specified belonged to one of my visiting relatives, not to my wife or me.
It's a hard problem to fairly solve.
- 3d secure would have made it hard to claim "wasn't me"
- banks here cancel cards involved in fraud, and request a police report (not really a very strong deterrent, but at least makes it risky/harder to repeatedly claim fraud, when it isn't)
Many US-issued cards don't have any meaningful form of 3-D Secure, and many of those that do just have an automated set of risk checks, but not the newest versions common in Europe with live customer authentication through app or one-time passcode. I've actually never seen that level of security on any card from the US or Canada, though I won't guarantee that there isn't some card there which offers it.
Similarly, in the US and I suspect also in Canada, a police report is not a routine part of how credit card issuers handle fraud. Not even when the customer is the one to report the fraud to the bank, instead of the bank automatically detecting it.
Aligning the incentives and the funding to get the US from where it is now to a place that would solve the problems we’re discussing is indeed quite hard - but not technically, as you quite rightly point out, at least when there is adequate time + resources + will available to implement and require the existing technical solutions.
Rather it’s hard financially, politically, legally, culturally, and logistically to achieve those circumstances where adopting the existing technical solutions goes from theoretically possible to done.
In particular, these problems are hard for Stripe to solve unilaterally from its particular position in the payments ecosystem, and/or for a single major US bank to solve without competitive disadvantage when its peers don’t also make the same changes.
> So for merchants in any country worldwide, this problem has only been solved decently well if they want to region-restrict their cards.
Well strong customer authentication is only relevant for online purchases, and I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :)
Yeah, I’m saying that the people who could make that happen don’t have the incentives to do it, so the right technical fix is politically, commercially, or financially infeasible for many of the people who would have to agree in this. Solving that problem doesn’t have an obvious right fix.
Why is it so different in the US? Simply put, credit cards were widely adopted before 3-D Secure (or even chips) existed, to such an extent that they’re even now far more dominant than they are in Europe, and the number of issuers and merchants is far greater and more evenly distributed across small businesses (yes even many of the issuers).
So any modernization of the US credit card infrastructure is hard and slow. You’d be surprised. Even having a chip in US cards only became widespread recently, but they still don’t usually have a PIN used when making a in-person purchase. (The cards still work in most but not all European payment terminals - the machine often requests a signature, though the staff only sometimes bother with it.) Canada does at least have chip and PIN as standard.
> Well strong customer authentication is only relevant for online purchases
If you’re talking about the EU legal requirement, yeah - although it actually doesn’t apply in full if the cardholder’s bank is outside the EEA, the UK, or one other nearby country, even if the transaction is in the EEA. (Weirdly, Switzerland is also out of scope, despite how integral it is to Central Europe, probably because it’s not in the EEA.)
But in the US, plenty of in-person fraud still happens too with cloned or stolen cards. Adding a chip has made this somewhat harder but not as much as you’d like, especially not without a PIN.
> I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment).
All of this very much depends on the business. For a business like OP’s which sells event tickets, if those event tickets have an international clientele such as tourists traveling from outside Europe or one of the few other countries where these technologies are commonly supported, there may not be any good other way to make the online ticket purchase happen.
Yes, credit (or effectively equivalent debit) cards without common 3-D Secure are that dominant in the US and Canada, although some people use PayPal or other local solutions too. In fact, credit and debit cards are the only way to buy online that’s routinely offered by most merchants in the US, so there’s no way to exclude non-European credit cards without excluding many US customers.
And lots of US or Canadian tourists in Europe really want to use the credit cards, because the fancy cards that frequent tourists or foreign-resident Americans/Canadians use often zero out the foreign currency cost with no foreign transaction fees, and/or because of reward points offered by the cards that are better for the cardholders (at more cost to the merchants) than what’s offered by issuers in Europe.
Traditional bank transfers (wire transfers) to Europe from outside the SEPA region are complicated, often slow, and expensive for both sides.
Plus keep in mind, the US and Canada are not the only countries where banks don’t have to offer strong customer authentication. It’s only required in the EEA and a few other countries. So when I said “international clientele” I don’t only mean North Americans.
> Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :)
If this does apply to US-issued cards, that might be why the two US-issued cards which I routinely use in Europe have finally added the frictionless flow version of 3-D Secure. However they don’t support the kinds that actually involve the customer in a live authentication, just some fully automated checks.
I know the situation in US, I don't believe it's a problem of "cost" or "widespread use" (e.g. haven't heard about beggars taking credit card in the US - the card usage is far more widespread in Europe). Card fraud is not curbed in the US because there's no political will to do it, not because it's not possible or it's too expensive. If there was a PSD2-equivalent law, all banks would quickly implement it and y'all would wonder why this wasn't done sooner.
Yeah, but most Americans who frequently deal with foreign expenses don’t want to pay with PayPal for them, since they are much more expensive for currency conversion than the traveler-focused US credit cards, don’t give the same legal protections to the cardholder in case of merchant misbehavior or data breach, don’t get covered by cardholder benefits like insurance, and don’t give reward points like the good US cards.
> It's funny you bring up tourists - because these are exactly the people who had to get cards with PIN (when their banks didn't offer them), or risk being unable to use them in Europe. So the fact that they "want to" doesn't mean that the merchants do, in fact, bend over backwards to allow them - it was the US tourists that had to adapt. So it's possible!
My life is a living counterexample to what you say is necessary for US tourists in Europe. I’ve been living in Germany for over 2 years now on various short-term immigration statuses (and yes legally despite the total duration). The main way I pay for most non-invoiced expenses both online and in person is a US-issued credit card with no PIN, only frictionless-flow 3-D Secure (no life customer option), and no foreign transaction or currency conversion fee. It works fine in pretty much every case I’ve encountered in Germany where cards are accepted at all, aside from sometimes having to sign. I do pay certain expenses by SEPA bank transfer or direct debit, but mostly medical or government expenses, rent, and certain peer to peer payments.
Cards with no tap to pay and no chip are a problem in Europe, but both of those are widely available in the US now.
> I know the situation in US, I don't believe it's a problem of "cost" or "widespread use" (e.g. haven't heard about beggars taking credit card in the US - the card usage is far more widespread in Europe).
You’re overgeneralizing about Europe and misgeneralizing about the US. Here in Germany, international cards like Visa and Mastercard were not that widely accepted before the COVID-19 pandemic, and even now most Germans don’t hold an actual credit card.
Beggars certainly don’t tend to take cards in Germany, though maybe they do in some of the most cashless European countries. In the US, sure beggars don’t typically take cards there either, although I’ve heard of isolated examples of it happening.
Looking overall rather than at atypical subsets like beggars, cards are indeed far more widely held in the US than in Europe, especially true credit cards but also the international type of debit card with a Visa (not Electron) or Mastercard (not Maestro) logo that can be used as if it were a credit card.
If you check statistics, be sure to look up statistics on how widely cards are held (and which types), not how widely cash is used. Many US people frequently use both cards and cash.
> Card fraud is not curbed in the US because there's no political will to do it, not because it's not possible or it's too expensive.
Why is there no political will to do it? Yes, it’s too expensive, a little bit for the merchants but especially for the banks. US merchants simply charge high enough prices to cover high credit card processing fees that let the banks eat the fraud (and/or pay rewards to their good customers). Customers don’t mind because they’re quite strongly legally protected, and the customers who don’t benefit from credit card rewards don’t feel ripped off because the relevant portion of the merchant cost structure is built into the listed prices. Nobody with sufficient influence and awareness of the situation has an incentive to change the system.
Even tap to pay was hard to get adopted in the US. Most initial attempts failed and were removed by the banks. It only became common once some major public transit systems started accepted it, and helped along by how the typical chip readers in use in the US at first were annoyingly slow.
> If there was a PSD2-equivalent law, all banks would quickly implement it and y'all would wonder why this wasn't done sooner.
If there were a PSD2-equivalent law, it would have a long transition period, banks or merchants would probably sue over it, there might be delays, and it might get watered down or repealed.
But yes, if the banks and merchants do go along with it, a law like that would be necessary to prevent competitive disadvantage as compared to the banks and merchants that wouldn’t voluntarily choose to do it.
> Why is there no political will to do it?
I don't know but I don't think there's a simple answer. Certainly not "it's too expensive", US can afford it. There's a cultural element to it, there's probably lobby of some interested parties. With cards in particular, it's also consumer apathy (as you say, people don't care - so no strong lobby is needed because no real demand for change exists). And maybe other reasons. But I don't think the status quo holds because it's too hard/expensive to change - it holds because there's not enough demand to change it.
A very simple way to change all this would be a law that moves liability to the bank (instead of merchant) in case of fraud. Sure banks would hate it (which is why it won't happen), but also if it happened, they'd then have actual incentives to prevent fraud/ would need to start seriously contemplating "what is more expensive".
This has changed a lot since the pandemic, but only since then, and cash-only places are still common. However even many of the cards that people do now carry in Germany aren't true credit cards, unlike in the US. (True credit cards are however now accepted in most places that accept any cards, at least in Berlin, with a few exceptions.) Germans are very hesitant to accept even the level of debt that is involved in charging to a credit card which one pays off in full by the monthly due date, which doesn't usually involve paying interest.
> But even so, I'm surprised you can do large-value payments without PIN; even if you have a contactless card, those are limited to small-ish sums (less than 100E I believe) - so yeah you can buy a croissant, maybe you can even buy lunch in most restaurants - but it still can randomly ask for PIN on some expenses, AND it always asks for large expenses.
You're probably describing how things typically work for cards issued in your country, but that primarily depends on the issuer's policies, mostly not those at the point of sale. I'm familiar with what you describe from having lived in Canada before, where I did have some cards issued in Canada as well as my US-issued ones.
But that's not the way it works for US-issued cards. There isn't even a PIN for my card to prompt for if they wanted to prompt for one, since the card doesn't support that functionality; the most they can do, and this sometimes happens, is prompt the staff to ask for my signature. Some of the time the staff actually does ask me to sign, other times they don't.
I think they can also ask me to insert the chip, but most of the times this occurs (not all), it's the merchant trying to upsell me on a marked-up currency conversion option instead of just letting my bank convert for free. (Even for the many US cards which do charge for currency conversion, the typical merchant conversion mark-up is still higher than what the cards would charge, and then the cards often charge their fee anyway since it's still a foreign transaction regardless of currency.)
As for the 100 euro limit, I'm surprised if such a low limit still exists in your country. For the Canadian cards where I had a similar $100 or $200 limit, they raised the limit during the pandemic and never lowered it. My US card has no relevant such limit - I frequently tap for amounts above 200 euros at the pharmacy, and recently tapped a 1500 euro charge at a veterinary surgical clinic. Some of these ask me to sign, but generally not to insert the chip, and definitely no PIN. All in Germany, yes.
> I don't know but I don't think there's a simple answer. Certainly not "it's too expensive", US can afford it.
"Too expensive" doesn't always mean "too expensive to afford if it were to be prioritized". It can mean "too expensive to justify the expense". Which I think is in fact true in the US, at least given the various risks, incentives, and costs of the various parties involved.
> With cards in particular, it's also consumer apathy
It's not just consumer apathy - US laws are so protective of consumers who are victims of fraud that consumers in the US almost never lose any money or much money to card fraud, especially credit card fraud but even many cases of debit card fraud. Unlike on most topics, US laws in this area are far more consumer-protective than EU laws.
> But I don't think the status quo holds because it's too hard/expensive to change - it holds because there's not enough demand to change it.
Which is another way to say it's too hard/expensive to change. That is, it's too hard/expensive to be worth changing, not too hard/expensive to be possible to change.
> A very simple way to change all this would be a law that moves liability to the bank (instead of merchant) in case of fraud. Sure banks would hate it (which is why it won't happen), but also if it happened, they'd then have actual incentives to prevent fraud/ would need to start seriously contemplating "what is more expensive".
They'd also very successfully lobby to delay, weaken, or repeal that law, while making the cheapest possible noises toward compliance in the interim. Doing so is far cheaper than proactively complying in good faith.
Got sent through the flow but couldn't complete the purchase as he wasn't answering his phone.
One and only time I've seen it though and I wouldn't doubt its a fancy card or enabled due to account value or something.
As I said, figuring out the right fix is not easy. But I don’t see how the current situation is defensible as okay, except as maybe reflecting the natural way for each of the individual actors to behave given the various incentives which are presently applicable to them, or as better than any specific proposal currently available for how to fix the situation.
This is not finger-pointing. This is literally how disputes work. Stripe has no role to play in this and they have clarified this in their docs:
> Throughout this process, Stripe facilitates your case, but doesn’t have influence over the outcome, which is at the sole discretion of the account owner’s bank.
-----
> This is a lie because I never even sent them the IP address since that isn't shown in the evidence I submitted.
What if they already have a record of IP address of who did the transaction and they are saying that it doesn't match the geolocation of the customer?
What if it really was a fraudulent transaction as claimed?
The merchant should consider what they can do to protect themselves in such cases, if they are not protected, such as being able to cancel the tickets.
What about this could Stripe have done better? Eat the cost of any disputes or fraudulent charges that the bank judges not to be fraud?
If I pay for something with a credit card and win a dispute with my bank, should Visa do its own investigation? And if Visa's investigation is different than my bank, do they comp the merchant?
Banks already do dispute resolution. It's maybe not the most objective system since the bank is getting paid by the customer, but it's the system we have. I'm not sure why Stripe should have this responsibility as well and I don't see how switching to a payment method other than cash or crypto would've prevented the customer from winning.
In a developing country, the bank would accuse the customers of fraud on behalf of the merchants.
Ahhhh! Stripe is a payment gateway. They’re an intermediary / frontend that simplifies away the complexity of negotiating with each bank and getting your own contract with each bank and integrating with each one separately.
I’m sorry to say this, but chargeback fraud is fraud, and you as a business have to deal with that. This customer might have millions in debt with BoA that they’re dutifully servicing. But someone has to eat the cost, and the reality is that this time, it’s you.
Either you can take the customer to court or you can ban them from future payments. Alternatively, you can try a payment method that isn’t as easy to dispute, but you’re still exposed to fraud at some level.
Let's count to 5 until we get:
"Hi, this is xxx (CEO/CTO of Stripe), this should not have happened. Drop me a mail at xxxx@xxx.xxx and I will have a look at this. (-: "
Can we get a CEO in here? A CTO at least? Come on Stripers, I know you are reading this.