4 ms·

I think this is likely a really bad idea for 'side projects' ... by acting as the middle man here you are taking on a huge amount more liability than you would

by aquark 10y ago

I think this is likely a really bad idea for 'side projects' ... by acting as the middle man here you are taking on a huge amount more liability than you would be if you are using the (non-managed) Stripe connect model where the your customer has their own processing account. Sure, there is money to be made here, but it isn't free and you need to manage the extra risk and liability that comes with it. What if someone discovers your platform hasn't got the same anti-fraud/verification processes that the larger players can afford by virtue of being a larger player, and decides to take advantage of it?

matheweis 10y ago
This, this, this, this. Commented about this issue above but then found this comment here later. I've read about side-project startups that have gone under because they tried to do their own payment stack and lost at the fraud detection game. See https://news.ycombinator.com/item?id=10234287 https://news.ycombinator.com/item?id=10234287 -------- Since pro accounts initially cost £6 for month, it turns out that this is low enough that it won't send red flags to stolen cards. ... If there's a dispute on Stripe, there's transaction fees for reversing charges. £15.34 in fact. Since I know I'll lose the dispute, it's cost me, £21.54 to allow some shithead to use JS Bin as a stolen card testing facility. --------
- Jach 10y ago
  Another good story about reducing test fraud: https://www.candyjapan.com/how-i-got-credit-card-fraud-somewhat-under-control https://www.candyjapan.com/how-i-got-credit-card-fraud-somew...
chenster 10y ago
> "..Sure, there is money to be made here, but it isn't free and you need to manage the extra risk and liability that comes with it." What's behind the EXRTRA risk? Couldn't he just simply pass over the liability to Stripe who's the actually payment processor?
- jermaustin1 10y ago
  You can, and we did. We had an accounting software that was used in some pretty big Martial Arts schools, we handled their payments through Authorize.Net (stripe didn't exist yet), but in the contract, we told them a reversal will cost (making the numbers up because it has been so long) $25 + the transaction and a bounced eCheck was $30 + transaction. These fees were directly pass through, we didn't try to profit on them. That said, the number of fraudulent card/check or bounces was 0. We were the payment processor for a business, not working with skeezy customers directly (like Duet is). If there is fraud, you bill that back to YOUR customer. Just like Stripe bills you for a bounced check or a reversal, you bill your SaaS customer.
  - swalberg 10y ago
    The fraud I'm worried about isn't from a bona-fida customer, it's from a fraudulent customer. BadGuy uses your service to sign up for BadGuyDojo, and attaches a stolen bank account. 10 "customers" sign up with stolen credit cards, process payment, and the money is gone along with them. A month or two later the credit card companies come looking to you for the money.
    - jermaustin1 10y ago
      The experience you are talking about wouldn't really jive with the real world scenario which this would be deployed in. I'm a small business owner and you are my client. You and I have a relationship. You aren't a random BadGuy. The likelihood of you purposefully bouncing a check or committing fraud is next to nil. In this scenario, similar to what Duet is doing (facilitating communications and payments between known vendor-client relationships) the SaaS that processes the payments is pretty safe from fraud. Now, I would never roll this out on any of our SEO services. When we had credit card payments on the earliest version of Linklicious, we fought over $1200/mo in charge backs from fraud or "fraud." After nearly 3 months of our mailbox filled with chargebacks and complaints, we switched to PayPal and only once did we have an obscene amount of fraud (hundreds of signups from stolen French PayPal accounts) at which point we blocked the country of origin for a week and the problem disappeared. You have to be intelligent no mater what payment method you chose. There are negatives on both fronts.

by aquark 10y ago

matheweis 10y ago

This, this, this, this. Commented about this issue above but then found this comment here later. I've read about side-project startups that have gone under because they tried to do their own payment stack and lost at the fraud detection game. See https://news.ycombinator.com/item?id=10234287 https://news.ycombinator.com/item?id=10234287 -------- Since pro accounts initially cost £6 for month, it turns out that this is low enough that it won't send red flags to stolen cards. ... If there's a dispute on Stripe, there's transaction fees for reversing charges. £15.34 in fact. Since I know I'll lose the dispute, it's cost me, £21.54 to allow some shithead to use JS Bin as a stolen card testing facility. --------

Jach 10y ago
Another good story about reducing test fraud: https://www.candyjapan.com/how-i-got-credit-card-fraud-somewhat-under-control https://www.candyjapan.com/how-i-got-credit-card-fraud-somew...

chenster 10y ago

> "..Sure, there is money to be made here, but it isn't free and you need to manage the extra risk and liability that comes with it." What's behind the EXRTRA risk? Couldn't he just simply pass over the liability to Stripe who's the actually payment processor?

jermaustin1 10y ago
You can, and we did. We had an accounting software that was used in some pretty big Martial Arts schools, we handled their payments through Authorize.Net (stripe didn't exist yet), but in the contract, we told them a reversal will cost (making the numbers up because it has been so long) $25 + the transaction and a bounced eCheck was $30 + transaction. These fees were directly pass through, we didn't try to profit on them. That said, the number of fraudulent card/check or bounces was 0. We were the payment processor for a business, not working with skeezy customers directly (like Duet is). If there is fraud, you bill that back to YOUR customer. Just like Stripe bills you for a bounced check or a reversal, you bill your SaaS customer.
- swalberg 10y ago
  The fraud I'm worried about isn't from a bona-fida customer, it's from a fraudulent customer. BadGuy uses your service to sign up for BadGuyDojo, and attaches a stolen bank account. 10 "customers" sign up with stolen credit cards, process payment, and the money is gone along with them. A month or two later the credit card companies come looking to you for the money.
  - jermaustin1 10y ago
    The experience you are talking about wouldn't really jive with the real world scenario which this would be deployed in. I'm a small business owner and you are my client. You and I have a relationship. You aren't a random BadGuy. The likelihood of you purposefully bouncing a check or committing fraud is next to nil. In this scenario, similar to what Duet is doing (facilitating communications and payments between known vendor-client relationships) the SaaS that processes the payments is pretty safe from fraud. Now, I would never roll this out on any of our SEO services. When we had credit card payments on the earliest version of Linklicious, we fought over $1200/mo in charge backs from fraud or "fraud." After nearly 3 months of our mailbox filled with chargebacks and complaints, we switched to PayPal and only once did we have an obscene amount of fraud (hundreds of signups from stolen French PayPal accounts) at which point we blocked the country of origin for a week and the problem disappeared. You have to be intelligent no mater what payment method you chose. There are negatives on both fronts.