5 ms·

A few months back, I was hit with an attack from a spammer, who managed to place a few hundred orders through my Stripe checkout. It seems they were attempting

A few months back, I was hit with an attack from a spammer, who managed to place a few hundred orders through my Stripe checkout. It seems they were attempting to place thousands of orders, and looking for functional credit card information. When I reached out to support, they acknowledged that this was a type of attack, and I needed to manually go back and unapprove all of these purchases coming from a single IP address, that wasn't being stopped by Stripe. Would I still need to pay to do all those fraudulent charge backs? If so, that single attack would have cost me hundreds of dollars out of pocket.

patio11 7y ago
I'm sorry that happened to you. Could you email me at this handle at stripe.com? I want to look into why we didn’t auto-detect that surge in suspicious transactions. We’re here to support startups. If you ever have a unique circumstance, write us; we’ll try to be reasonable, in the same fashion that your hosting provider will try to be reasonable if an engineer e.g. fumble fingers a deploy and briefly turns on a larger fleet of servers than they intended. (It's worth noting, for precision's sake, that a refund is not a chargeback. Chargebacks are when the person who actually owns the credit card calls the bank to complain; they're strictly worse for all parties than simple refunds.)
- abduhl 7y ago
  While this is an interesting response, it strictly does not the answer the poster’s question. Would they be liable for the fees for an attack like this?
  - patio11 7y ago
    It's difficult for me to predict our response in every possible hypothetical circumstance, so I'm promising what I feel we can actually promise: a human who cares about your success will review the circumstances and make a judgment call.
    - deleted 7y ago
      [deleted]
    - joecool1029 7y ago
      Translation: Come to HN with your problems and you'll get the VIP treatment while there's a spotlight on the company. Attempting to find an answer as an outsider lead me to this PR release from last year: https://stripe.com/newsroom/news/chargeback-protection https://stripe.com/newsroom/news/chargeback-protection < It makes me assume that if the merchant wasn't paying that extra fee they are going to be slammed.
      - commoner 7y ago
        I don't think that press release is applicable, since no chargebacks are involved here. According to Stripe's documentation (see submitted link), the merchant must still pay the 2.9% + $0.30 processing fee for each refunded transaction, unless Stripe's customer service representatives waive the fees as an exception. But there is an issue with this euphemism in the parent comment: > a human who cares about your success If Stripe "cares about your success", Stripe would return the processing fee on all refunded transactions (regardless of whether they are fraudulent) just like Square and Amazon Pay does.
      - NicoJuicy 7y ago
        He's given an honest answer, the situation has to be checked. You don't know that the poster is 100% honest also. Patio has always been transparent and honest, long before he joined Stripe ;)
        commoner 7y ago
        patio11 gave a nonanswer, which is hardly transparent. > a human who cares about your success Regarding honesty, if Stripe "cares about your success", Stripe would relinquish processing fees for all refunded transactions (regardless of whether they are fraudulent) just like Square and Amazon Pay do.
        7y ago
  - deleted 7y ago
    [deleted]
dkroy 7y ago
Just to be clear in this example a chargeback wouldn't have happened. A chargeback can only happen if there was a valid credit card that made a purchase that requested a reversal of the money transfer.
mattferderer 7y ago
That happened to a non-profit I help as well. We were attacked by someone using different IP addresses testing out credit cards. Stripe caught a lot of these but surprisingly it seemed several went through that we had to refund & pay the transaction fee for. A lot of these didn't even require the CVC check it seemed. We were able to get fairly good support, 100 times better than most places I deal with. Unfortunately we had to switch to Radar for Teams to put in fairly basic checks such as making sure CVC verification happens before accepting the card. This costs a bit extra per transaction. At the end of the day we were able to get it solved. Stripe puts plenty of human resources on helping & they have fairly good documentation. It does really stink that we need to purchase Radar for Teams just to add a few basic rules in place to prevent scammers like this. We lost around $100 that could have went to helping families whose kids have cancer which always sucks. We also had to implement an "invisible" Google Captcha which I wasn't a fan of. This could have been a lot worse though which is what troubled me the most.

patio11 7y ago

I'm sorry that happened to you. Could you email me at this handle at stripe.com? I want to look into why we didn’t auto-detect that surge in suspicious transactions. We’re here to support startups. If you ever have a unique circumstance, write us; we’ll try to be reasonable, in the same fashion that your hosting provider will try to be reasonable if an engineer e.g. fumble fingers a deploy and briefly turns on a larger fleet of servers than they intended. (It's worth noting, for precision's sake, that a refund is not a chargeback. Chargebacks are when the person who actually owns the credit card calls the bank to complain; they're strictly worse for all parties than simple refunds.)

abduhl 7y ago
While this is an interesting response, it strictly does not the answer the poster’s question. Would they be liable for the fees for an attack like this?
- patio11 7y ago
  It's difficult for me to predict our response in every possible hypothetical circumstance, so I'm promising what I feel we can actually promise: a human who cares about your success will review the circumstances and make a judgment call.
  - deleted 7y ago
    [deleted]
  - joecool1029 7y ago
    Translation: Come to HN with your problems and you'll get the VIP treatment while there's a spotlight on the company. Attempting to find an answer as an outsider lead me to this PR release from last year: https://stripe.com/newsroom/news/chargeback-protection https://stripe.com/newsroom/news/chargeback-protection < It makes me assume that if the merchant wasn't paying that extra fee they are going to be slammed.
    - commoner 7y ago
      I don't think that press release is applicable, since no chargebacks are involved here. According to Stripe's documentation (see submitted link), the merchant must still pay the 2.9% + $0.30 processing fee for each refunded transaction, unless Stripe's customer service representatives waive the fees as an exception. But there is an issue with this euphemism in the parent comment: > a human who cares about your success If Stripe "cares about your success", Stripe would return the processing fee on all refunded transactions (regardless of whether they are fraudulent) just like Square and Amazon Pay does.
    - NicoJuicy 7y ago
      He's given an honest answer, the situation has to be checked. You don't know that the poster is 100% honest also. Patio has always been transparent and honest, long before he joined Stripe ;)
      - commoner 7y ago
        patio11 gave a nonanswer, which is hardly transparent. > a human who cares about your success Regarding honesty, if Stripe "cares about your success", Stripe would relinquish processing fees for all refunded transactions (regardless of whether they are fraudulent) just like Square and Amazon Pay do.
        7y ago
- deleted 7y ago
  [deleted]

dkroy 7y ago

Just to be clear in this example a chargeback wouldn't have happened. A chargeback can only happen if there was a valid credit card that made a purchase that requested a reversal of the money transfer.

mattferderer 7y ago

That happened to a non-profit I help as well. We were attacked by someone using different IP addresses testing out credit cards. Stripe caught a lot of these but surprisingly it seemed several went through that we had to refund & pay the transaction fee for. A lot of these didn't even require the CVC check it seemed. We were able to get fairly good support, 100 times better than most places I deal with. Unfortunately we had to switch to Radar for Teams to put in fairly basic checks such as making sure CVC verification happens before accepting the card. This costs a bit extra per transaction. At the end of the day we were able to get it solved. Stripe puts plenty of human resources on helping & they have fairly good documentation. It does really stink that we need to purchase Radar for Teams just to add a few basic rules in place to prevent scammers like this. We lost around $100 that could have went to helping families whose kids have cancer which always sucks. We also had to implement an "invisible" Google Captcha which I wasn't a fan of. This could have been a lot worse though which is what troubled me the most.