8 ms·
I hate to see this honestly. Stripe is already notoriously vulnerable to credit card fraud and this is likely not helping their cause. I'd love to know how lon
by rwmurrayVT 11y ago
I hate to see this honestly. Stripe is already notoriously vulnerable to credit card fraud and this is likely not helping their cause.
I'd love to know how long you should expect for an ACH payment to clear and into your bank account. The two day period for credit cards is so small. Who checks their statements every single day? This is obviously the benefit of using Stripe if you're the merchant, but it leaves you vulnerable.
We can only pray that Stripe accepts some responsibility for verifying these ACH transfers.
Fraud on Stripe is a two-fold problem. They've got fraudsters signing up for Stripe accounts and running cards through them. They've also got fraudsters making purchases on Stripe-based sites. Obviously, Stripe prefers that the charges are made to legitimate users. That way they're not out all the money.
Edit: It appears it could take "up to 5 days" for the payments to be processed. This is entirely on the bank's side of the equation. I guess from there you'll only need to wait your 2 days (7 days for some users) to receive the ACH into your bank account. I see massive fraud coming in here.
- matthewarkin 11y agoThe micro-deposit requirement or Plaid (logging into the bank account) should ideally minimize fraud. But for consumers ACH fraud is sadly way more difficult to deal with than credit card fraud.
- rwmurrayVT 11y agoThis is unfortunately not the case in reality. It is quite easy to get access to high value checking accounts for less than 50 USD. They could be personal or business. For between 25-75 USD you could get access to all the login information you need to access Wells Fargo/SunTrust/BoA accounts. You could see both Plaid micro-deposits. Even PayPal has faced this issue and they're solution was to be a huge pain in the fucking ass to users. Balancing convenience with security for ACH is not an easy task. That's why ACH is so damn hard to do online.
- zachperret 11y agoPlaid co-founder here. When users connect their accounts via the Plaid instant verification process, we actually allow developers to get a greater understanding of the user. Via Plaid, you can do things like validate the available balance and check the account owner's identity -- which can significantly reduce the likelihood of ACH fraud.
- rwmurrayVT 11y agoPlease read my response below.
- wesleyfsmith 11y agoAs someone who recently started integrating with Plaid in my app, I can verify that the extra information they give you access to is extraordinarily beneficial to better understanding your user. Also, asking for account and routing numbers is a massive inconvenience to users.
- rwmurrayVT 11y agoUnfortunately, that will only stop people who run around taking photos of other people's checks. Does Plaid provide information about the location the checking account was initially opened or the general location of the account owner's residence? The biggest problem with Stripe is they provide ZERO checks on IP location + billing/shipping zip code, checking the email against known fraudulent email addresses, or shipping location against known drop locations.
- zachperret 11y agoYes, Plaid can help with most of this. You can see the full docs at https://plaid.com/docs https://plaid.com/docs for more details.
- rwmurrayVT 11y agoI have just taken a look at your documentation! It seems very good. I definitely underestimated how advanced you are currently. It'll be interested to see how this plays out. You'll be tested by very smart people. Right off the bat one thing you should really try to change is the lack of MFA by Wells Fargo. You should beg and plead to have them do something. They're by far the most available and cheapest accounts sold online.
- zachperret 11y ago
- pmorici 11y agoReally? I've been using Stripe for a couple years and never had a problem with fraudulent transactions. Do you require zip code verification?
- rwmurrayVT 11y agoWhat products are you selling? If you sell something high value and easily resellable then you should count your blessings. It's become a bit harder to identify a Stripe-based site without investigating. Even with zip code verification you have minimal protection. There are no geo-location checks for IP + billing/shipping zip code or other protections. Stripe should bundle with a service like MaxMind IMO.
- nemothekid 11y agoWe've been using Stripe ACH's payments for a couple months now (coming from Balanced), and the whole process, from charge to bank, takes around 7 business days, and the statement shows up on day 1. I consider this a long time, so long, that I'm actually considering on working directly with a bank myself and plugging into ACH network directly (The way we operate, its faster for some clients to just be paid through PayPal and cashout through PayPal). As far as fraud goes, ACH charges can be reversed with no questions asked for 60 days if it turns out the charge was unauthorized (with no recourse, except asking the customer). On the other side, if a fraudster has your bank credentials, and can confirm with micro deposits, this is no different than them going to PayPal or Venmo with that same information.
- dlanouette 11y agoCan you talk about why you moved from Balanced? They've had AHC payments for a long time, haven't they?
- itsthisjustin 11y agothey shut down and migrated all their users to the stripe ach Alpha
- mlm 11y ago(I work at Stripe.) For credit card processing, automated fraud prevention does in fact come standard on all Stripe accounts and takes into account a great number of signals including some that you brought up below, like whether the location of the IP address used matches the location of the billing address. For ACH, we've built even more stringent verification--as well as any other signals we might take into account, purchasers have to demonstrate, through microdeposits or Plaid, that they have direct access to the bank account in question. It's impossible to prevent all fraud, but we take it very seriously and are investing heavily in continually improving and expanding what we do there. It sounds like you may have had some specific bad experiences, and we'd love to hear your feedback and suggestions for improvement. Please do reach out--I'm mlm@stripe.com.
- rwmurrayVT 11y agoThis is not coming from a specific bad experience. Quite the opposite. I just got home from a commute. I will email you shortly. I am curious how good it is if it is standard.. Some how major vendors lost quite a lot of money on hoverboards with Stripe.
- tyingq 11y agoYour description does not match Stripe's documentation. Specifically, there's no mention of matching geo-IP to billing address. The problem I see with Stripe's fraud prevention is that it appears to be "all or none", with no visibility or control on our end. The only control knob appears to be whether to allow Stripe to automatically decline things it thinks are fraud. It doesn't appear to provide any detail on why it thought something was fraud. So it seems to leave two choices: - Allow stripe to decline things, and try to address false positives manually. There is no "go ahead and charge this button", by the way...you would have to contact the customer. - Set stripe not to decline things, but lose even the limited visibility to "stripe would have declined this". The real problem, in my mind, is that fraud risk for both the banks and providers like Stripe is really small. You risk very little. The vast majority of the cost goes back the individual merchants/sellers, who have the least visibility into what the risk of an individual transaction is. Thus, there's very little incentive for the banks, or stripe, to provide decent tools. A shame, because your ability to see the bigger pictures means your tools would always be better than anything we can use.
- egillie 11y agoSome companies layer external fraud protection on top of stripe. Have you tried any of those, or do you know if other payment processors (braintree, adyen, etc) have better built-in fraud protection?
- rwmurrayVT 11y agoBrainTree is incredibly vulnerable over mobile.
- ZacDavies 11y agoWhy do you say that?
- rwmurrayVT 11y agoThat's what I've heard in the circles. I'm inclined to believe it. Security over mobile is lagging behind desktop. The tools to spoof geolocation and device identity are light years ahead.
- jtdowney 11y agoI'm the Security Lead at Braintree. I am not sure what you're hearing in these circles. If someone could send details to security@braintreepayments.com we'd be happy to take a look.
- matthewarkin 11y agoI like Braintree's model a bit more, the provide the API consumer with the raw AVS and decline codes from the card processor (while Stripe just says "card_declined"). Braintree also allows you to do finer grain controls such as "Decline charges that fail a zip code check for charges over $500" or "Decline if the bank doesn't support zip code checks." And with about 2 lines of code you can add more advanced things like device fingerprinting and geolocation through Kount. *Disclaimer: while I don't work for Braintree yet, I start there in June (though my experience with Stripe is very strong).
- jasontan 11y agoSift Science (http://siftscience.com http://siftscience.com) CEO here. We focus on helping online businesses like Airbnb, Match.com, and OpenTable automate away their fraud problems with realtime machine learning. Many of our customers use us an additional layer of protection in addition to what Stripe or any other payment gateway offers. I'm happy to answer any questions about fraud.
- rwmurrayVT 11y agoEmail me :) rwmurray(@)vt.edu