Hacker News Reader

Comment by weego | Hacker News Reader

The post talks about unauthorised charges. There is no way to validate the card prior to Stripe capturing payment, so they certainly are not upset about people using stolen cards on your own site, as you have no way of mitigating that. The migration to Stripe that I handled a year or so ago had 5 or 6 stolen cards/people iterating card lists looking for working cards per day and never had a complaint from Stripe.

Once you have a card you can absolutely take arbitrary amounts of money from it, and this appears to be their suggestion. It could well be that they are using (purposely) vague wording that confuses people about their charging structure (in one off payments or subscriptions) which generates complaints to banks and then Stripe have to deal with it. Or it could be a big misunderstanding Stripe side and they have done nothing wrong. I have an opinion on which one I think is most likely.

View on HN

Sort of. Some products are real magnets for stolen card use, for example anything that sells "gift cards" or "stored value card" where the crooks can convert a one time use of a stolen credit card into a 'clean' gift card. Some forms of merchandise are similar.

Some products are real magnets for stolen card use

Charities also have huge problems with CC fraud, as they're seen as an easy target to test card details against before making the "full" purchase elsewhere:

http://www.bankinfosecurity.com/stolen-cards-tested-on-chari...

> as you have no way of mitigating that.

Actually, you do. In many cases, fraud follows a pattern. If you're a merchant, and you're getting a lot of fraudulent charges, you'll often get into a discussion with your upstream processor's fraud department about the details and how to mitigate it. I don't work in payments anymore, but as an example of how this works, I was talking a few weeks ago with a merchant who does tens of millions gross every year, but also faces five digits of fraudulent transactions. They sell car parts, so it's quite easy to buy one or two things for a lot of money. While working with their processor, they discovered that a significant amount of fraud was coming from two cities. And not just two cities, but two neighborhoods. And not just two neighborhoods, but two streets.

They simply reject any transaction from that street before even sending things to the processor, and now they're saving tens of thousands of dollars a year.

Why doesn't the processor do this?

Preventing fraud is the most difficult part of payment processing; are they outsourcing it to the merchants?

Processors do their own fraud as well. But, as they're based on heuristics, the more context you can give, the better. Depending on how exactly they do fraud, they may not see a specific kind of fraud coming through one customer, but may be better at seeing fraud spread out amongst customers.

You know your customers and business better than anyone, even your own upstream.

> they certainly are not upset about people using stolen cards on your own site, as you have no way of mitigating that

They get upset about it anyway, because Visa/MC mandates it. A reversal ratio above ~1% threatens Stripe's ability to act as a processor. A bit of Googling will turn up plenty of people with terminated accounts for excessive chargebacks, just the same as any credit card processor.

You're partly incorrect. Stripe has supported auth+capture for a while now. You're no longer required to capture the payment immediately.

https://stripe.com/docs/api#capture_charge

Stripe lets you validate address and zip code prior to charging.

Reply on news.ycombinator.com