6 ms·

This looks very promising. Stripe seems to have sometimes let surprising payments through up to now, even with all the card details security checks they provide

This looks very promising. Stripe seems to have sometimes let surprising payments through up to now, even with all the card details security checks they provided activated, and they've never supported 3-D Secure. They've also suffered from surprisingly high rates of unexpected declined charges in our experience. Hopefully if they're now rolling out more comprehensive fraud protection, that will go some way to addressing all of those concerns, so best of luck to them with this new development. Edit: It appears there's a small per-transaction charge for their enterprise customers on custom plans but it's now included for free with the standard pricing. Can anyone confirm this?

tarstarr 10y ago
(I work on Radar at Stripe) thank you, and do let me know if there's anything we can do to help you get set up on Radar. Additionally, we actually do support 3Dsecure in private beta -- mind emailing me (tara@stripe.com) for access?
- markonen 10y ago
  Please please please promise that it will always stay optional?
  - ceejayoz 10y ago
    From playing around with it a bit, it appears you can disable any and all rules, if you want.
- Silhouette 10y ago
  Thanks for the reply. Ironically, we probably have much less interest in 3-D Secure if Radar will now let us deal with the same "sudden spike in dubious sign-ups" problem anyway. One interesting possibility might be if the kind of rules you allow for Radar could be used to determine whether to apply 3-D Secure if it's available, so we could enable it selectively for countries where people don't already have a zip/postal code to verify for example. However, for my own small businesses, I suspect we'll be more interested in what Radar can do, particularly to add immediate extra security checks if we are suspicious of a pattern of requests from a certain part of the world.
tarstarr 10y ago
(just saw your edit) Radar is included for the vast majority of our users who are on the standard rate. If you're an enterprise customer on a very custom plan, there's a small per transaction fee.
deleted 10y ago
[deleted]
sly010 10y ago
We had the same experience, unfortunately most of stripes "declined" charges are actually declined by the bank and stripe cannot, nor is willing to help you out. They are just a gateway. Once it happened on my own site with my own card, I called my bank's security team and asked what is the exact reason on their side and all they could tell me over the phone that they declined the transaction only because it was too "high risk" My theory (just a theory) is: A. banks fraud detection systems just don't like the way stripe is avoiding the whole merchant account game, so stipe just has a bad rep at banks B. stripe is so easy to set up and use, therefore various stripe websites has fraudulent transactions going on, so from the bank point of view just being a new merchant coming through stripe is automatically high risk The whole machine learning for fraud detection imho is very annoying from a merchant point of view, because there is no real way to fix it. We have had cards that got declined only the second-third month in a rent-to-own business and the only thing we can do is to ask the customer to call their bank. Hopefully once fraud detection happens at the stripe level instead of the bank level, banks will see less fraud coming from stripe and the overall decline rate will ... decline.
- Silhouette 10y ago
  Agreed on pretty much all of that. We too have wondered whether the ease of use that makes Stripe so attractive to a small business might also induce some sort of penalty in terms of fraud checks by other organisations. If that really is the case, presumably it leaves Stripe in a tough situation, but this seems like a responsible and hopefully effective step on their part. We see quite a lot of failures on the second month of a subscription, particularly for customers abroad (we're in the UK). We also tend to see these sort of failed charges happen in waves, with few problems for a while but then a sudden spike in declined transactions. That suggests at least one plausible explanation: the lack of CV2 after that first charge may be enough to tip something over the edge into "too suspicious" territory following some sort of update in the overall scoring scheme used by whoever is blocking the charge. We're looking into various potential ways to improve the situation, such as allowing more automated retries of failed charges over a longer period before we give up, and possibly advertising prices in our customers' local currencies. However, each of those has some potential downsides and obviously there is only so much you can do as the merchant anyway. If Radar can start to make Stripe, and by extension its merchants, a harder target for for fraudsters, maybe that will also move the needle a bit. A few times I think we've lost more subscribers in a month to failed card charges than everything else put together, including customers actively choosing to cancel and including failures via all other payment methods we accept, so it's definitely an issue worth exploring.
morgante 10y ago
> they've never supported 3-D Secure That's a feature. It's a horrible system which I wish nobody ever used. I've literally never been able to successfully complete a transaction.
- Silhouette 10y ago
  It's not great in many respects, but it has the compelling advantage of shifting fraud liability from the merchant to someone else. Depending on your market, it may be worth the loss in conversions from activating it. Even if you're in a normally low-fraud market, as every business I work with that takes card payments is, almost anyone taking small value card payments on-line is vulnerable to being used as a card testing engine if their system can be automated. If nothing else, being able to toggle the extra check on temporarily if you become aware that your system is being abused that way is an extra level of security you can apply in a hurry.
- fomojola 10y ago
  I've experienced 3D secure and verified by visa effectively insulating a merchant from chargeback risk (I'm talking 99% success rates winning chargebacks). You're right, it is incredibly user-hostile and truly painful to integrate (as compared to Stripe) but if you're in a business that sees a lot of people trying to rip you off it works wonders.
  - wmf 10y ago
    It works wonders in eliminating chargebacks by also eliminating legitimate customers?
    - detaro 10y ago
      Fewer customers but a lot less fraud could very well be the more profitable and safe option.
      - morgante 10y ago
        Perhaps, but it's important to actually run that calculation. After all, shutting down web payments entirely would totally eliminate fraud—but also cripple your business in the process. Personally, I will never use a 3D Secure system these days. If you require it, I'll simply skip purchasing.

tarstarr 10y ago

(I work on Radar at Stripe) thank you, and do let me know if there's anything we can do to help you get set up on Radar. Additionally, we actually do support 3Dsecure in private beta -- mind emailing me (tara@stripe.com) for access?

markonen 10y ago
Please please please promise that it will always stay optional?
- ceejayoz 10y ago
  From playing around with it a bit, it appears you can disable any and all rules, if you want.
Silhouette 10y ago
Thanks for the reply. Ironically, we probably have much less interest in 3-D Secure if Radar will now let us deal with the same "sudden spike in dubious sign-ups" problem anyway. One interesting possibility might be if the kind of rules you allow for Radar could be used to determine whether to apply 3-D Secure if it's available, so we could enable it selectively for countries where people don't already have a zip/postal code to verify for example. However, for my own small businesses, I suspect we'll be more interested in what Radar can do, particularly to add immediate extra security checks if we are suspicious of a pattern of requests from a certain part of the world.

tarstarr 10y ago

(just saw your edit) Radar is included for the vast majority of our users who are on the standard rate. If you're an enterprise customer on a very custom plan, there's a small per transaction fee.

deleted 10y ago

[deleted]

sly010 10y ago

We had the same experience, unfortunately most of stripes "declined" charges are actually declined by the bank and stripe cannot, nor is willing to help you out. They are just a gateway. Once it happened on my own site with my own card, I called my bank's security team and asked what is the exact reason on their side and all they could tell me over the phone that they declined the transaction only because it was too "high risk" My theory (just a theory) is: A. banks fraud detection systems just don't like the way stripe is avoiding the whole merchant account game, so stipe just has a bad rep at banks B. stripe is so easy to set up and use, therefore various stripe websites has fraudulent transactions going on, so from the bank point of view just being a new merchant coming through stripe is automatically high risk The whole machine learning for fraud detection imho is very annoying from a merchant point of view, because there is no real way to fix it. We have had cards that got declined only the second-third month in a rent-to-own business and the only thing we can do is to ask the customer to call their bank. Hopefully once fraud detection happens at the stripe level instead of the bank level, banks will see less fraud coming from stripe and the overall decline rate will ... decline.

Silhouette 10y ago
Agreed on pretty much all of that. We too have wondered whether the ease of use that makes Stripe so attractive to a small business might also induce some sort of penalty in terms of fraud checks by other organisations. If that really is the case, presumably it leaves Stripe in a tough situation, but this seems like a responsible and hopefully effective step on their part. We see quite a lot of failures on the second month of a subscription, particularly for customers abroad (we're in the UK). We also tend to see these sort of failed charges happen in waves, with few problems for a while but then a sudden spike in declined transactions. That suggests at least one plausible explanation: the lack of CV2 after that first charge may be enough to tip something over the edge into "too suspicious" territory following some sort of update in the overall scoring scheme used by whoever is blocking the charge. We're looking into various potential ways to improve the situation, such as allowing more automated retries of failed charges over a longer period before we give up, and possibly advertising prices in our customers' local currencies. However, each of those has some potential downsides and obviously there is only so much you can do as the merchant anyway. If Radar can start to make Stripe, and by extension its merchants, a harder target for for fraudsters, maybe that will also move the needle a bit. A few times I think we've lost more subscribers in a month to failed card charges than everything else put together, including customers actively choosing to cancel and including failures via all other payment methods we accept, so it's definitely an issue worth exploring.

morgante 10y ago

> they've never supported 3-D Secure That's a feature. It's a horrible system which I wish nobody ever used. I've literally never been able to successfully complete a transaction.

Silhouette 10y ago
It's not great in many respects, but it has the compelling advantage of shifting fraud liability from the merchant to someone else. Depending on your market, it may be worth the loss in conversions from activating it. Even if you're in a normally low-fraud market, as every business I work with that takes card payments is, almost anyone taking small value card payments on-line is vulnerable to being used as a card testing engine if their system can be automated. If nothing else, being able to toggle the extra check on temporarily if you become aware that your system is being abused that way is an extra level of security you can apply in a hurry.
fomojola 10y ago
I've experienced 3D secure and verified by visa effectively insulating a merchant from chargeback risk (I'm talking 99% success rates winning chargebacks). You're right, it is incredibly user-hostile and truly painful to integrate (as compared to Stripe) but if you're in a business that sees a lot of people trying to rip you off it works wonders.
- wmf 10y ago
  It works wonders in eliminating chargebacks by also eliminating legitimate customers?
  - detaro 10y ago
    Fewer customers but a lot less fraud could very well be the more profitable and safe option.
    - morgante 10y ago
      Perhaps, but it's important to actually run that calculation. After all, shutting down web payments entirely would totally eliminate fraud—but also cripple your business in the process. Personally, I will never use a 3D Secure system these days. If you require it, I'll simply skip purchasing.