The AMEX people just keep saying Stripe has a "iron clad contract" so even with that, they cannot do much.
I am not saying it is a 100% Stripe. But why would a company like Stripe allow me to do (successfully) 7 chargebacks in a row. At what point would an account be shut down or a subscription terminated? If this was PayPal, the account would have been frozen ages ago.
Even with a brand new credit card, reported as stolen, what ever. If a monthly subscription contract exists (which you sign once you click that button to pay $5 monthly I guess), they can continue charging the account.
This was what AMEX rep told me.
I guess this is both for customer convenience and to give the bank more flexibility, but I think this would be a lot simpler if closed credit card numbers just stopped working.
https://stripe.com/docs/saving-cards#automatic-card-updates
> Stripe works with card networks and automatically attempts to update saved card details whenever a customer receives a new card (for example, replacing an expired card or one that was reported lost or stolen).
> It is widely supported in the United States, allowing Stripe to automatically update most American Express, Visa, Mastercard, and Discover cards issued there.
My god.
It doesn’t quite work like that in Europe, as far as I know. The fact that you file chargebacks over and over and they don’t do shit is even more insane.
Which is annoying in its own way because when your card expire, you need to manually re-enter its new details into all the services you're using. And you (or at least I) will inevitably forget one of these until you need it urgently.
I would get super annoyed at the US behaviour.
Although in the US people still subscribe to "newspapers" where you can subscribe online but have to wait for hours on hold on a hotline to end the subscription...
Not to pile on poor Sam here. This is a common thing in the finance industry, and tech, and basically everywhere.
While it’s a fair point that with PayPal, you are almost entirely SOL, whereas with Stripe you at least have a chance, it’s not a tenable solution.
The fact the founders quickly offered assistance directly, when they’re business is worth tens of billions is at least worth giving the benefit of the doubt. Even if it’s just for PR, they’re at least doing it.
Why the hell would you praise a company for an empty gesture? You're defending bullshit like it's a good thing.
I’m assuming they’ll fix the problem, even if it’s just for PR purposes.
Anyway I misread your previous comment, sorry about that.
The problem is they decided to leave up their Stripe account and just stop replying.
What am I missing?
I'm sure most devs have an experience where something is broken for weeks before you happen to overhear someone talking about the multi-step workaround for a 5 minute code fix.
I think the same kind of issue applies.. Support teams are encouraged to not escalate, if they do, it often goes to a higher level support (but not any developers/business people). They find a clever solution and that becomes the common practice. It's not until a big stink is made that the right people are aware of a possible problem, and perhaps only then investigate the scope of that problem, and realize it needs prioritization.
Of course, this doesn't answer why the support team didn't even read the email to see you're not asking for a password reset... But might be a contributing factor.
https://github.com/mastodon/mastodon/issues/5634
So people came back to empty timelines. Terrible UX, but until someone both experienced it and mentioned it, no one with code access realized how bad this was for returning users. Now there's a friendly message letting returning users know what's going on.
What helped fight this was to create a rule in Radar to reject all cards without 3D Secure capability, but it had cut off a sizable chunk of legit revenue.
Something cheap turns into a $15 dispute fee.
(Disclaimer: I used to work at Stripe on the dispute resolution team. I no longer work at Stripe.)
If your fraud has a large enough monetary value, large enough scale, or you work with another person on it, you can get hit with a serious felony charge and end up in prison for a few years. Disclaimer: I am not a lawyer or expert on credit card fraud.
Sort of like the highway system relies on an agreement not to play bumper-cars. There's nothing actually stopping anyone.
Self-preservation.
A chargeback with stripe costs like $15 for the seller. Even if the charge was only $1.5. Imagine the monetary problems you could create and the seller has no other way than to pay and hope to not get banned.
Anyway, the merchant eats fraud for card not present transactions. So why would the bank choose to reduce its payment volume in order to reduce fraud it doesn't even have to pay for?
If the merchant says 3D Secure only, it reduces fraud, but also reduces payment volume, because most customers will choose to use a merchant with less friction, especially if their issuing bank doesn't do 3D Secure, or it's broken when they go to purchase.
Reducing fraud is good for merchants, but it the drop in sales may not be worth it. There's a lot of other things merchants can do to reduce fraud that aren't likely to cut into sales as much.
Block every single fraudulent or suspicious transaction, and you're leaving obscene amounts of money on the table.
The amount of credit card fraud that goes unclaimed or is eaten by liability shift is huge, so if Stripe makes a product like Radar ACTUALLY WORK, they would be missing out big time.
I am confident Stripe's radar's shortcomings are deliberate and not simple bugs or design problems.
It appears they have no incentive for the product to be 100% effective and that would explain why Stripe Radar is billed per screened transaction, regardless of outcome.
We benchmark Stripe Radar against other pure play fraud fingerprinting solutions, and the difference is abysmal. The fact that Stripe claims to have seen 80% of any card before it gets to your store make this fact even worse.
So, like parent says, you are going to see radar scores of 90 and 95 for certain charges (clearly fraudulent carding attempts), followed by scores of 15 or 20 for the same card, IP, fingerprint with absolutely no warning.
I've grown tired of escalating this to Support. They just give me the ML model answer. Basically: "It's a black box!"
You can definitely add a rule to start blocking charges from X places, or with Y velocity, or always enforce 3DS, but then you're taking the model into your own hands, and that has some important consequences.
Your acceptance rate goes down. You're heavily interfering with the model and relying (and trusting) it less, and you realise you really don't need Radar to do that for you.
If you're serious about fraud, you must use a pure player solution that is 100% aligned with your interests.
From what we've seen with Stripe Radar in the past, that doesn't seem to be the case.
I'm a big fan of Stripe in may ways, but I really have a love/hate relationship with this side of their business...
Stripe Radar costing money is a bit annoying too - my solution was to block non-Australian cards - but the only way to do that is with Radar, which costs money. Radar doesn't let you whitelist currencies either.
What's a payment method actually worth where you have so little control if the payment succeeds?
Would much prefer a solution simpler/easier/less devstating than dropping Mjölnir on it.
As far as I know, it's not granular, per-merchant, so you can't skip the fraudulent merchant while updating the legitimate ones.
Furthermore, some banks may not even give control to the user about whether this happens or not.
Customer can see these tokens anytime, along with merchant details, and customer can revoke these tokens anytime.
At that point it becomes a legal problem for them and I suspect they'll be forced to take more serious action.
This doesn't sound like a particularly difficult bar to clear.
- The damages in question would exceed hundreds of thousands of dollars
- You want to make an example out of the defendant and have lots of money to burn
- You are engaging in litigation as part of a settlement extortion scheme ala Prenda Law
America does not award legal fees to the victor - in fact, it's considered so un-American that American lawyers literally call it the British Rule[0]. As a result, small actors - which you almost certainly are - will bankrupt themselves just getting to the discovery phase, regardless of if they are plaintiffs or defendants.
In a few situations, this has become such a problem that US law either provides time-saving motions for common forms of nuisance lawsuits[1] or uses it as a way to encourage certain behaviors[2] out of litigants. However, this kind of fraud case will almost certainly not fall under such measures, and you are almost certainly too small to defend.
Representing yourself in court is technically possible but practically a death sentence to your case. And an actual lawyer would tell you exactly what I've told you, except with actual attorney-client privilege[3] involved, and they'd charge you for telling you that. Except they'd probably also add in a bunch of stuff about class-action waivers and binding arbitration[4] that would make it nearly impossible for them to represent you.
[0] I've also heard French Rule.
[1] Such as Anti-SLAPP motions, though these are not in federal law yet.
[2] The copyright registration system comes with a few key perks; notably statutory damages and the ability to recover attorney's fees. If you do not have either you cannot economically sue a copyright infringer, which sounds like a really good way to comply with Berne without complying with Berne.
[3] I am not a lawyer.
[4] For what it's worth, there are some crafty lawyers that have figured out a way to help people mass-arbitrate, but companies are trying to fight back against that too.
Sue them in small claims court. You won't get significant money, but they'll have to burn a little money on lawyers. You have the chance at the moral victory of the judge saying you're right*. You probably have a decent chance of getting on the HN front page when you first file and when you win/lose. You have a noticably higher chance at being covered in the mainstream media than if you just complain on the internet.
*The judge generally doesn't literally say you're right
There are several other Merchant of Record alternatives, but I have not found something that can do quite the programmatic approach you can with Stripe.
I am a customer of their banking service and I played with their APIs. It feels like Stripe at the beginning, hopefully they'll be good for this decade
Unfortunately, I’m going through a divorce right now so I can’t cancel that credit card. But, as soon as I’m free that’s on the top of my list of things to do to start living the rest of my life.
https://usa.visa.com/dam/VCOM/download/merchants/visa-accoun...
https://developer.mastercard.com/product/automatic-billing-u...
https://www.americanexpress.com/us/merchant/cardrefresher.ht...
It’s Citi’s fault for not flagging the change being for fraud reasons, which skips the updaters.
Also how should I describe a rather basic problem? I told them every aspect of it multiple times to multiple tiers of customer service. Email chains (or lack thereof), website details (include login), they already have transaction details.
customer -> card issuer (amex) -> card network (amex) <- card processor (stripe) <- merchant -> customer
So as you can see, you have no relationship with Stripe. Your have a relationship with Amex and the merchant. Those are your points of contact.
When you make a chargeback, Amex accepts this chargeback, and sends it to the merchant's processor, who then presents it to the merchant for response. This is a process defined in the contracts between each of the parties.
To your other question regarding fraud controls in this system, that's handled in the contracts:
- If you skip out on your debt, Amex must still pay for any charges they authorized. (The payment flow is customer -> Amex -> stripe -> merchant. This flow is reversed for a chargeback/refund.)
- If a merchant skips out, stripe is still responsible for any chargebacks.
Think about what this means: If stripe accepts too many high-risk merchants, they'll lose money. If Amex accepts too many high risk customers, they'll lose money. So they each have an interest in controlling fraud.
So what happens when a merchant gets too many chargebacks (typically less than 1%): Stripe will refuse to do business with that merchant. Why would they do this? Because if Stripe has too many chargebacks, the card network will refuse to do business with Stripe. They may be able to recertify as a high risk processor, but that comes with additional requirements... and if its above those high-risk levels, the card network won't allow stripe to process any payments at all.
This is all defined contractually.
What is the contract you have? You have a contract with Amex: your credit card terms. And you have either an implied or explicit contract with the merchant that they must meet.
Stripe and Amex are not fully aware of your contract with the merchant (refer to first relationship graph above). Part of the chargeback process is the merchant's response. A valid chargeback defense is that the charge meets the contractual terms the customer agreed to (assuming nothing illegal is going on). When the merchant presents the contract in their response, Stripe and Amex can review that contract. Amex (as the card issuer) gets to decide if they accept or reject the merchant's response and issue a decision on the chargeback. (Stripe (on behalf of the merchant) can disagree with this, and it then goes to the card network for a decision.)
So that's the whole process.
If you go to stripe directly (as a customer), you're attempting to do an end run around this contractually enforced process... and stripe isnt going to do that (unless they want to be sued for tortious interference by the merchant).
So hopefully you can see why Amex telling you to call Stripe is so bizarre. What makes it even more odd is that the type of dispute you have is something Amex handles like a 1000 times a day... they have a process for it.
And FYI: Amex can block a merchant from charging you in the future. (Easy on their part: just stop authorizing the charge from the merchant.)
While I believe everything you said, I have not experienced it.
Sometimes when I’m on with CS, if I let it slip that I know a little something about what’s wrong they take the easy out and send me on my way by regurgitating what I just said as the solution.
The average person doesn’t know anything about Stripe or payment processing. I find it hard to think Amex would steer you that way out of the blue.
Is Amex really saying “here’s a phone number to some third party, resolve it yourself”? Totally unprompted?
I would call in and pretend to be as dumb as possible. All you know is you keep getting charged and you don’t want the charges anymore. The business phone number you have is disconnected. Let them take it from there.
Your best bet is to get in contact with someone who is in sales who can escalate this to an engineer or other more technical person. One way to do this may be to declare that you will tell your customers AMEX is no longer acceptable unless they help you resolve the issue. This may seem harsh but I bet it would work at AMEX and not a VISA or Mastercard
No idea why this is, and no idea why anyone would give out his data to unknown companies under this conditions.
This means it's an 800 pound gorilla in a dev/bay friendly costume (docs? API?).
They cannot fix the financial system unless they can become Wells. That will not happen. Thus, their actions, pricing, and product development choices all point to Wells.
PayPal has this exact theme of a problem. Or lack of solving.
[0]
Essentially, they screen transactions; if any approved transactions are chargebacked, they refund you.
A good start point is https://signifyd.com
We dropped in this solution on our e-commerce about 5 years ago; fraud has been a non existent problem.
As expected, just a couple of bucks accumulated. Then a user sent an unsolicited $15 donation, along with an accompanying comment, asking for macOS user support, for help solving a user issue entirely unrelated to my project. I declined, explained the situation and offered to refund the donation. I never received a reply, but immediately after, I received a chargeback notification. Stripe took the $15 from my account as well as a $15 chargeback fee. The user claimed fraud. An appeal went unanswered, despite me providing all required proof.
In the end, this little experiment cost me money. It also opens up a disturbing avenue of hurting someone financially, given enough credit cards and chargebacks.
The website doesn't work, the email doesn't work, I charge it back every single month, yet Stripe doesn't care one bit.
Attempting to contact Stripe results in emails asking if I need help resetting my password (yes I legit sent an email asking for them to investigate the "company" and they sent back a reply with details on how to reset my password), to telling me to contact my credit card provider.
Honestly both companies are giant bags of turds, if you can you should look elsewhere, you can save money on almost every fee, there are alternatives to every single product they provide, and pretty much all of the alternatives are varying degrees of better or cheaper.