6 ms·
Steal a Credit Card, Buy a Hoverboard
- MarkCole 11y ago"According to internal Stripe documents obtained by BuzzFeed News, online hoverboard purchases are plagued by fraud." "Documents show that as of Dec. 7, Soulja Boy’s Stripe account held a balance of $-174,440.08. Between June 30, 2015, and Dec. 7, according to the same documents, more than 75% of all orders associated with that account were disputed after the fact." I find the fact that someone at Stripe is leaking financial documents/information of customers (presumably for some sort of personal gain) to be HIGHLY disturbing. Maybe it's time they reviewed who has access to what sensitive information there.
- shiftpgdn 11y agoI find it funny that an SV darling like Stripe offers its customers no anti-fraud measures like companies like Authorize.net do.
- andyfleming 11y agoIt's interesting that Stripe customers knowingly, or most likely unknowingly, have overlooked anti-fraud measures and taken on additional liability in exchange for a good user interface and easy setup.
- jthnme 11y agoTrue - and once you are a merchant eager to sell and make a living, you really don't pay attention or maybe don't realize that money charged and received is not yours yet to keep. One thing that all users should do is enable CVC check. Believe me it is better to deal with some user complaints and manual processing then refunding fraudulent payments and screwing with your cash flow.
- jthnme 11y agoActually Stripe does have anti-fraud (https://stripe.com/docs/fraud https://stripe.com/docs/fraud) just unfortunately it is not that great. Speaking from experience - I would pick Stripe anytime, even if they are not perfect, the simplicity to start using them (and stop, if needed) + the all-over attitude and possibilities are way better then the old-school behemoths like authorize.net or braintree.
- deleted 11y ago[deleted]
- gambiting 11y agoIf you were selling something online and you only accepted bitcoin, you would sell very little of whatever you were selling.
- deleted 11y ago[deleted]
- gambiting 11y agoWell I assumed you meant legal things. The article in question is about hoverboards, and I guess would you sell very few hoverboards if you only accepted bitcoin.
- deleted 11y ago[deleted]
- gambiting 11y ago"The sandwich you just sold was purchased with stolen money. Give us the money back." This means, that the seller has no sandwich and no money. In reality he has to pay a fine in form of a chargeback fee, because he did not detect, that this money was stolen. WTF?" Well, the problem is that the real life works exactly like this. If you pay someone $1000 for a laptop, and the laptop turns out to be stolen, the police will take it away without giving you anything. Now you have no money and no laptop. Money is a bit trickier, since in general it will not be taken away even if it comes from a robbery, but there might be exceptions to that.
- tommorris 11y agoThere's also Bitcoin mining equipment for sale in BTC. Because it isn't a ponzi scheme at all.
- needusername 11y agoThere is of course a "solution": 3DS. But it's so horrible that American card companies (VISA and MasterCard) only force it on the rest of the world, not on the US of A.
- matt4077 11y agoIt actually works ok for me. I get an sms within 5 seconds and type in the code, done. Not sure if it could lead to problems in more complicated scenarios, i. e. when I'm not using a desktop computer in my home country.
- needusername 11y agoSending an SMS for every online authorization does not required 3DS.
- Sujan 11y agoBut it's another solution that works, isn't it?
- needusername 11y agoIf you're cool as a user / ch with 3DS then it's an OK solution.
- matt4077 11y agoI wonder how the vendor can be described as "unreputable". It seems like the vendor has the least possibilities of all those involved (banks, cc companies, stripe) to spot fraud. The credit card companies also reap all the benefits of making it easy to use their cards (no pin, no 2FA) but apparently pass the losses from that policy on to the vendors.
- pcr0 11y agoExactly what I was thinking. The whole point of using something like Stripe is to hide complexity, why should users have to roll their own fraud prevention?
- celticninja 11y agoHow can they have this level of fraud with a physical product that has to be shipped somewhere?
- zoidb 11y agoMy assumption here is that it is cost prohibitive to go after individuals so the loss is just written off.
- celticninja 11y agocost prohibitive? Some of the losses in in the hundred of thousands, almost millions of dollars. Sure it might not be worth Stripe or the Credit Card companies going after the fraudsters because they get the merchant to pay. But for IO Hawk to just leave it and not follow up seems like business suicide. Even if they did it just to tighten up procedures in future to prevent future fraud it would be worthwhile. Perhaps they were all posted to reshippers, then you would ban reshippers from being the delivery address, or you make suspect requests wait longer for delivery, not even formally telling them, just adding in a 30 day shipping delay or soemthing.
- jthnme 11y agoTricky part that nowadays you tend to optimize your business.. so if i would host e-store, stock all my things in fulfillment center, and automate it all. I would be left with empty warehouse, and negative balance in the stripe account... also - In stripe - if you refund and mark payment as fraudulent there are no fees. If someone disputes payment later on - there is a fee.. so.. as long as you are honest.. no extra fees occur.
- URSpider94 11y agoThey mention that in at least one case, most of the fraudulent purchases came from a single IP. Whomever it is has arranged a place to drop-ship the boards that will be untraceable. Perhaps they use addresses of unoccupied homes, then just pick up the packages from the doorstep. I know in the past, criminals have used fraudulent accounts at local mailbox rental stores, which they rent for a month and then dump. Point is, there are plenty of ways to launder shipments, if you are doing it with a plan and at scale.
- binarnosp 11y agoShouldn't Stripe be responsible for checking frauds and detecting them? Or shouldn't the credit card company deny the transaction for stolen cards? A low percentage of fraud is admissible, but the level mentioned in the article raises a few red flags.
- sschueller 11y agoThis is ridiculous, it is the responsibility of Merchant and card companies to provide some sort of guarantee that the cards used are valid. Why do we even accept credit cards if they aren't better than someone saying I promise to pay you when I get your product.
- jrjarrett 11y agoSo what's the connection between hover boards and fraud, I wonder? Why not something else?
- MarkCole 11y agoPerhaps due to them being trendy? You use your stolen credit card to buy high value items with a resale value. Resell the item to someone else, and you have turned those numbers on a screen into cold hard cash.
- rwmurrayVT 11y agoStripe has been known to be incredibly vulnerable to online fraud. They provide effectively 0 fraud prevention for their users. Any merchant using Stripe is just a sitting duck for an extreme spike in fraudulent purchases. Even as recently as 2 weeks ago lists of Stripe-based merchants float around. Even worse, any bimbo with a SSN and bank account in the USA can sign up. If you've got someone's SSN and address you can open a Stripe and bank account in their name. Run up the Stripe balance with stolen cards and then disappear. Stripe holds initial payments for 7 days and a rolling 2-day period. Clearly from this article most people don't charge back for a long time, well over 7 days. Stripe has a fraud problem. They've been denying it and IMO have failed to bring in fraud prevention experts. They should partner with MaxMind and create a single, easy to implement product.