6 ms·
Stripe charged me $714 for duplicate transactions within seconds
I just had a client pay $8,200, and they must have hit the submit button over and over. 6 times actually, but luckily their bank blocked all but 3 of the payments.
I had to refund 2 of those, and Stripe has charged me $714 in refund fees.
Their live chat and phone support all insist that it's expected that Stripe would process $8,200, submitted over and over within seconds to the same credit card, and wouldn't block it.
I guess it's true that I signed up for this when I signed up for Stripe. And it's obvious that the payment flow was misconfigured and the least I could do is disable the submit button upon click.
Although wow... I would have trusted Stripe to have some degree of obvious safety net against duplicate transactions until today.
I figured I'd put this out there in case anybody else finds themselves in the same situation.
- rogerkirkness 7y agoTwo words: idempotency keys. I personally feel Stripe does people a huge disservice not turning this on by default. We did something similar in the earlier days before idempotency keys. Worse than that, it was on a debit card...
- DougWebb 7y agoJust came to recommend idempotency keys as well. https://stripe.com/docs/api/idempotent_requests https://stripe.com/docs/api/idempotent_requests
- friendly_fren 7y agoWhy are you using stripe to process transactions that large? It makes no sense to pay 3% on that.
- newsbinator 7y agoThis is for a Hong Kong company processing a US client's credit card. What would be a better option?
- nickfromseattle 7y agoWire transfer. Fee is capped at $35.
- newsbinator 7y agoGood suggestion. Is there a convenient (for the end user) approach to handling wire transfer on a web page? (i.e. the polished Stripe checkout version of wire transfer)
- olliej 7y agoNope, they have to initiate from their bank. Many of which don’t have online WT services (the fraud potential is clearly huge)
- user5994461 7y agoIf it's a Hong Kong customer, obviously doing international business, they're most likely banking with HSBC and have good online banking with instant bank transfer.
- newsbinator 7y agoThat was my best information as well- the process of initiating a wire transfer from their bank is likely too much friction in many cases. Not to mention the lack of protection the buyer would feel, as compared to a Credit Card.
- dnh44 7y agoDo banks still exist that don’t allow for online international transfers? Are you sure?
- olliej 7y agoSmall credit unions, and I don’t recall seeing any on NZ banking sites when I grew up - they essentially have domestic WTs because you can send money to anyone’s bank account online (in NZ having someone’s bank account number means you can send them money, not the US absurdity of withdrawing money)
- Someone1234 7y agoThey offer Idempotent Requests[0][1] to prevent exactly this. While I think it is a shame you're in this position, I am surprised anyone would perform card transactions without a debounce of any kind (even disabling the UI element until the previous request completes/fails). As to if Stripe should "allow" this; while I think $8,200 is too much for repeat transactions, I don't think repeat identical transactions is that odd in general. Even within a couple of seconds (e.g. 99 cent in-app-purchases). The only thing that surprises me is that there is no upper limit/sanity check. You could ask them to waive some of the fee, but some of it might be their costs. [0] https://stripe.com/blog/idempotency https://stripe.com/blog/idempotency [1] https://stripe.com/docs/api/idempotent_requests https://stripe.com/docs/api/idempotent_requests
- leto_ii 7y agoAt a brief glance it seems they ensure idempotency w.r.t. possible errors/network failures etc. not necessarily to multiple purchases done by the customer by mistake. In that case I think some high velocity fraud filters should kick in (which they probably did). Indeed the purchase amount is very large, so you wouldn't really expect it to be a repeated high velocity buy. On the other hand Stripe can't really cover all possible edge cases all of the time.
- celticmusic 7y agoYou render a UUID into the browser form and send it along with the submission however you want (post input, http header, etc). Then the server both requires the UUID to be there and passes it along to stripe. Stripe will not allow an idempotent key to be reused w/i 24 hours. You can use anything for the idempotent key and Stripe will actually track that along with the charge object so you can use something more meaningful if it's useful for your business. edit: and if you generate a key that's more meaningful I'd be careful about leaking important/private data.
- leto_ii 7y agoYeah, but that should only prevent duplicates due to technical errors, but not duplicates because the person actually made a number of distinct purchases my mistake. Take a look also at edwinwee's answer below.
- mtm7 7y agoOuch. Did this happen on a Stripe-hosted checkout form, or did you use something like Stripe Elements to handle it yourself?
- rococode 7y agoNot OP but it sounds like they were using Elements ("the payment flow was misconfigured and the least I could do is disable the submit button upon click"). I would hope that Stripe's own checkout form is well-rounded enough to handle things like this.
- edwinwee 7y agoAgree with the other comments on idempotency. If you need help with that, please let me know. (Also: Stripe‘s Payment Intents API is asynchronous, which means no double charges. I’d recommend looking into it! https://stripe.com/docs/payments/payment-intents https://stripe.com/docs/payments/payment-intents) I’d love to take a closer look at exactly what happened if you email me at edwin@stripe.com.
- leto_ii 7y agoJust out of curiosity, does the idempotency guarantee cover deliberate shopper actions, or just retries due to network errors? Shouldn't high velocity + high amount purchases be treated as potential (friendly) fraud and blocked by some fraud system somewhere?
- edwinwee 7y agoIdempotency doesn't. It's meant to prevent duplicate actions. For what you're talking about, that fraud system is already built into Stripe! Stripe's fraud shield detects high velocity (along with hundreds of other signals)[1]. You can also tune Stripe Radar[2] to block purchases with amounts that would be abnormally high for your business. [1] https://stripe.com/docs/radar/risk-evaluation#high-risk https://stripe.com/docs/radar/risk-evaluation#high-risk [2] https://stripe.com/docs/radar/rules https://stripe.com/docs/radar/rules
- leto_ii 7y agoThanks for the reply :)
- newsbinator 7y agoBig thank you to Edwin for emailing & helping me solve the issue.
- Nextgrid 7y agoThe whole idea of charging for refunded transaction is scummy. I have an old enough Stripe account from before they implemented this so I still enjoy free refunds but if I had to start today I’d definitely look around for another provider that doesn’t pull this kind of BS.
- deleted 7y ago[deleted]