16 ms·
Stripe banned us for payment disputes but we never had a single dispute
- philliphaydon 5y agoThis must be why majority of websites that support stripe also support other payment providers. Because stripe isn’t reliable. :/
- meylis 5y agoStripe is totally weak. I really hope you will fix it soon and never use stripe anymore. There are hundreds of reliable services
- hienyimba 5y agoWe literally don't have the resources to do so at this point.
- namelessoracle 5y agoWho wants to bet there was an engineer who pointed out all of the risks way earlier at the company and whose concerns were promptly dismissed....
- 0des 5y agoWhether or not this is the case here, this statement resonates with me on a few uncomfortable levels.
- meylis 5y agoMaybe if you can create a donation for that that would work. I would be really glad if you create a donation to use that money for better payment provider than stripe
- deleted 5y ago[deleted]
- shapefrog 5y agoSo Justuseapp Banned You for Payment Disputes but You Never had a Dispute?
- AhmedMhmed 5y agoWe always work with justuseapp without problems. You can get services to work again, please
- scandox 5y agoI think the OP would make a stronger case if they were more literal: they had exactly 1 dispute according to the evidence provided. In a sense the idea that you could be shut down for one dispute would be even more extraordinary.
- jsiepkes 5y agoI guess stripe wasn't kidding when they said they would disrupt online payments. On a more serious note; How much further is society going to allow this kind of thing? Hiding behind templated e-mails without any explanation. Disrupting people's lives who become collateral damage with no way out.
- afarrell 5y agoFor as long as it permits companies to hire fallible humans and to write machine learning models with false positive rates.
- nicoburns 5y agoThe machine learning models with false positives aren't the problem. The lack of a timely appeals process that involves a human is.
- jtbayly 5y agoBut that’s why the prices are so low. Society will put up with it as long as it works most of the time, because algorithms without humans are cheap.
- syshum 5y agostripe's prices / fees are not really that much lower, they do have great profit margins though
- nicoburns 5y agoI'm not sure about that. The companies employing these kind of techniques are typically making huge profits. I suspect supply and demand would dictate that a bunch of the cost came out of those
- naasking 5y agoI'm curious how many human reviews are triggered after ML flags a problem. If it's nearly 100%, why have the ML step at all?
- protomyth 5y agoHow are we a "high risk" merchant when our business is not different from Truebill.com (subscription tracking) and Ramp Inc (spend management) a company Stripe recently invested in? The cynical me says there is your answer right there. You are a bit to close to something Stripe invested in, or at least close enough to something they will offer as a service soon.
- meylis 5y agoIt makes sense. They (stripe) want to get the biggest part of a cake and destroy small businesses. Such morones.
- logicchains 5y ago>Such morones. Does that mean morons? From their perspective, it's a smart thing to do, if they can get away with it. Or does it mean like "such big balls?".
- Y_Y 5y agoAt least in Spanish "morones" are little hills.
- Sebb767 5y agoIf they wanted the biggest part of the cake, the should keep the small businesses next to their own. The know their competitors and, in the case of them failing, they'd still be on the winning side. As the saying goes, to make money in a gold rush, sell pickaxes.
- r_singh 5y agoThat's a ridiculous reason for blocking their account though. Is everyone learning from the best (cough Amazon)?
- sschueller 5y agoIt would also be illegal but going to court costs a lot of money.
- gadders 5y agoI think all payment processors grow until they hit scale and become paypal. This may be because at that scale they hit new regulations, or have to manage their customers as aggressively as paypal.
- afarrell 5y agoAs you scale, your probability that you will 1. Deal with bad actors 2. Misjudge an honest actor as a bad actor both approach 1. To make a general statement about Stripe, we'd need a broader statistical analysis rather than a single anecdote.
- marcus_holmes 5y agowell their website banned me from viewing it because I use a VPN, so I can't comment on the justice/injustice of their position. My irony sensor went off though.
- iav 5y agoMy SaaS business serves corporate law firms and investment banks that invest in large corporate bankruptcies (think Hertz). When I launched, I first applied for a merchant license from Stripe, and was quickly denied by an automated system, citing violation of TOS (no reference to what violation). But given there are a ton of alternatives, I just used Braintree instead and it's been a great experience so far.
- hef19898 5y agoSounds like a fun business, and industry!
- Zarathu 5y agoI really feel for the author. We had once decided to participate in Stripe's Identity Verification beta. After submitting the form to request participation, Stripe's system locked our account pending verification. We were fortunate in that we had a backup payment gateway integration "just in case", because otherwise we would have been completely unable to accept any payments at all for a full week. That week was still extremely stressful. They offered no explanation or reason for putting our entire business on hold.
- Spare_account 5y ago>We were fortunate in that we had a backup payment gateway integration "just in case" This seems like the key point here. I'm not a software guy or even a payments guy, I'm a network infrastructure engineer. For anything that we want more than 99% uptime, we put in two of everything, sometimes more. Two separate service providers, ideally coming down different physical paths where practical.
- dexen 5y ago"Treat infrastructure as possible failure points and prepare accordingly" holds just as well for the payment infrastructure. Interesting and fresh perspective, thank you for sharing.
- toss1 5y agoGreat practice, specifically determining how much redundancy you need, and making sure it is available. The theme also goes with your acct name quite nicely!
- wting 5y agoIt's not possible to increase availability with redundancy in all cases, because not all financial actions are idempotent. For example, sending money via a banking wire. If the bank goes down, you can't send a second wire through another bank without loss because the first wire is not retractable.
- dgb23 5y agoThat is a scary trust violation... Good for you that you went the extra mile in advance and not in hindsight.
- sudhirj 5y agoIf I understand correctly you use Stripe Issuing to give people cards that they can then spend with in a way that you control? How do people recharge their Justuseapp cards? You charge their real card and credit their virtual ones? And if one of the apps being used makes a unauthorised charge do you then raise a dispute on behalf of the customer? I'm not trying to apologise for Stripe, I'm trying to see what's special about this financial arrangement. It's obviously not a SaaS nor are you selling anything physical.
- InsomniacL 5y ago"You can then use the virtual credit card to signup for free trials on the web and on apps without worry. We approve only free trials and not actual purchases." I assume when you sign up to a free trail, they'll charge your card £0.00 to confirm it's a valid card, then when the trail ends and they try to automatically charge you for a full subscription they'll block the transaction. https://justuseapp.com/free-trial-card https://justuseapp.com/free-trial-card
- grey-area 5y agoThis is not the intended use for stripe issuing at all, and would lead to stripe handling thousands of disputes from companies trying to charge cards with 0 balance after trials end. I can see why they blocked it.
- hienyimba 5y agoFree trial cards were not issued with Stripe Issuing.
- reillyse 5y agoAlso not how disputes work
- InsomniacL 5y agoAutomatically charging a 12 month subscription after a free trail is not the intended consequence of signing up to a free trail for most people at all. It leads to thousands of disputes from innocent people being changed a lot of money they never intended to part with, sadly most will never get that money back.
- Swenrekcah 5y ago>We had worked hard to make sure we pose to risk to Stripe or card networks and it had worked! Our efforts had paid off. But that was not enough for Stripe. Unfortunately a word there. I hope this all works out for you!
- AussieWog93 5y agoI went through the same thing. Some ML algorithm at Stripe randomly classified my business (bog standard WooCommerce/WordPress e-Commerce store selling a single product in low volumes) as a risk and I found that the process for escalating it was Kafkaesque and slow. Switched to Pin Payments[1] shortly after that experience and have never looked back. Of course, we live in the 2021 century and algorithms will flag issues automatically (I ported my phone number and changed my bank account on the same day, which was fun!), but they've always made sure to contact me and resolve the issue within minutes instead of cutting access. The few times I've contacted them, a competent person has both understood the issue and responded to it appropriately and promptly. [1]https://pinpayments.com/ https://pinpayments.com/
- burlesona 5y agoThis product was leaning heavily on Stripe’s issuing API, so I don’t think pin payments is a viable alternative. I’m actually not sure if anybody else is a viable alternative. Is there another service that offers card issuing as an API?
- dylan604 5y ago>we live in the 2021 century I know I've been in lockdown for a while now, but what century is it?
- AussieWog93 5y agoThat's hilarious.
- travoc 5y agoThese types of problems could be fixed by doing the three things big tech hates: 1. Hire human beings 2. Empower them to fix problems 3. Let your users talk to them
- tiborsaas 5y agoHiring humans is not as scalable as technology is. You can't just hire 150 more customer support agents _each month_ like you can fire up another Kubernetes cluster. They need training, middle managers, leads, special training, good tooling, office space, adjusted KPI-s, etc. Ideally, good companies will find a balance with AI and human operators that's also sustainable as a business.
- Aeolun 5y agoIf your number of customers and revenue increases by 100%, you should be able to scale your customer support by a similar amount.
- JasonFruit 5y agoYou're saying, however, "We can scale our tech but not our business." If you could scale everything but payroll, that wouldn't make it okay to use an automated payroll system that left some employees unpaid with no recourse. Leaving your customers unjustly banned with no recourse is no more justifiable.
- kiklion 5y ago> Ideally, good companies will find a balance with AI and human operators that's also sustainable as a business. This is the crux of it. What do you define as a balance? In this example, Stripe shouldn’t be using ML to actually ban accounts but instead to flag accounts for manual review. My company distributes advertisements. We need to watch every ad we ever distribute to ensure both its quality and legality. We have and still are investigating ML to improve this process, but because regulations put the cost on us for false negatives, we would use ML only to identify when it knows an ad fails our checks. It would then pulls it from the QC queue before any tech manually reviews it and emails the client informing it was blocked and why it was blocked and a link to a form where they can request a manual review if they think it was a false positive. Our contracts allow for a fee to be imposed on the client if they challenge a block which is upheld after manual review. Doing it this way we reduced our tech workload by removing clearly violating ads from QC queue and we give the client a clear and quick way to challenge the results of the ML. At least, that is the plan here. It’s still in R&D.
- traveler01 5y agoFunny how this has beeing a tendency last years. Big american corps just banning small users/companies without any reason and not giving them support whatsoever. As a developer this puts a big dent on Stripe's reliability and I'm not advising it to any client. Ever.
- kylecordes 5y agoI think big companies tend to do this by accident, more out of incompetence than malice. Yet this sort of thing just begs for future draconian government interference. Seems to me a smart company would find a way to not invite that unpleasantness on themselves.
- traveler01 5y ago> I think big companies tend to do this by accident, more out of incompetence than malice. They have bots deciding the future of their users. And when the bots make some kind of mistake they don't give support for the costumer or neither check if the user got wrongly banned. It's some kind of sick blind trust they place on automated systems. Nothing wrong against these systems, but they should have a system in place to check wether these made a mistake or not.
- kmfrk 5y agoSilicon Valley wanting to "disrupt" industries seems to have a bad habit of becoming the thing they tried to disrupt. Guess you can put some money in an iceblock in front of their HQ and see what happens. Reminds me of when people loved online video like YouTube because of the lack of commercials.
- deleted 5y ago[deleted]
- Uberphallus 5y agoModeration has been proven not to scale with AI, seems like payments is the same.
- tyingq 5y agoI have a hunch their main concern is this kind of marketing on your site: "Access the American market Our credit card comes with a U.S. billing address, so you can unlock features restricted to the U.S or Western markets especially if you don't live there." https://justuseapp.com/free-trial-card https://justuseapp.com/free-trial-card
- mkr-hn 5y agoStripe might not even be allowed to say the reason if they brushed up against anti-money laundering policies. This is probably the exact reason for the ban, and the reason they wouldn't talk to the company about it.
- hienyimba 5y agoThe free trial cards were not offered with Stripe. They were offered with Flutterwave. It was launched in March. We started with Stripe in June.
- ceejayoz 5y agoThat might not matter.
- user-the-name 5y agoLooking at what service they actually offer, I can easily see why Stripe would not want to do business with them. They offer private credit card services, which seems like it could easily be a magnet for people trying to launder stolen credit cards and the like. Just because they have not yet been hit with this, does not mean they are not at risk of becoming a target if they get a bit more known. Stripe doesn't want to have to deal with that.
- hienyimba 5y agoWe preempted this by using Stripe radar along with our own tools. The fact we had only one charge-back in 3 months which we won, speaks to the efficiency of our protection mechanisms. Finally, all bigger software shops face this issue so we are not unique. 1. https://kinsta.com/blog/credit-card-fraud-stripe/ https://kinsta.com/blog/credit-card-fraud-stripe/
- user-the-name 5y agoBut that is just promises from your side. From their side, they have no idea how much effort you are or are not making, nor whether that effort will be enough or not. To them, you are a risk. They don't want that risk.
- zhuzhu 5y agoFUCK PAYPAL
- h0nd 5y agoThe more stories I read about VISA/Mastercard (yes, Stripe is there to accept payments of these networks) the less I want to use them. The only alternative I found so far were cryptos. (yes, there is paypal and such - but I have never seen any brick and mortar shop accepting it)
- DanielBMarkham 5y agoThere's an interesting efficiency/reverse-opportunity-cost issue here. If you set up your ML so that it works x% of the time, you might very well have a profitable business even if you end up accidentally screwing over a bunch of folks. But no competitor can challenge you in the marketplace because the human cost of answering phones and emails to find that last little bit of efficiency is overwhelmingly disproportionate to any economic value the business would gain. Many of us like to bang on businesses as being amoral and impersonal, but most are trying to do something people want, only better and more efficiently. ML may be providing an upper limit to efficiency by taking out any opportunity to do some serious analysis. Because in many cases removing that last 1-5% in inefficiency is the bit that leads to a completely new way of working, in many areas we may be boxing ourselves in to a very long-term status quo.
- quesera 5y agoYes. You can build a system that efficiently serves the 98% case of "simple" customers. Then you can ignore the 2% unprofitable/complicated customers, forcing them to go to other vendors. If you're big enough, you starve your competitors of the low-cost/simple customers. So their cost structure goes way up, which in turn prices the services out of reach of all other customers except the stupidly profitable, which is to say: gambling and porn. (This has parallels to the USPS v. FedEx/UPS problem in the US, with the exception that the USPS is required to serve all customers, so no one is completely without service)
- Aeolun 5y agoRecently quality of service at Stripe has gone seriously down the drain. They arbitrarily closed my account a while ago, and after following their draconian re-activation process (somehow my government issued ID is not good enough to identify me, they need to verify the same information and ID in a video call) I think we’re now at 20+ emails and counting. I just gave up and will go with a different provider or open a new account since it’s easier. At some point Stripe was the provider that took everyone, but they’ve become allergic to any kind of risk and trust nothing.
- mmerlin 5y agoMy speculative guess is they raised the bar on the low-pass filter by tightening up the algorithm after losing way too much to credit card fraud. It was absolutely scary the amounts of fraud I dealt with running a dropshipping shop a decade ago. Every bad fraud order that I dropshipped ate the entire profits from a dozen legit orders, and card fraud was attempted on approximately 25% of orders we received. After a few years I shut the site down as it was just barely making a profit as the fraud costs escalated and I felt I was wasting my time screening every order with my own (imperfect) hand-rolled fuzzy logic fraud detection algorithms and manual investigation of every single order. I false-rejected a lot of legit customers in the final year, vowing to stamp out the scammers I drove some customers away... it's hard to be perfect when card fraud is easy to achieve. Actually what the final straw was for me, that made me delete the server, was not the regular identity fraud stolen-card scumbags, but the pathological liars who you could validate as 100% legitimate, but after they received and signed for the goods, would call their bank and lodge a chargeback to get a full refund, because he banks ALWAYS take the customers side and ALWAYS charged me an extra $35 penalty for every dispute I lost (which was every single one, despite sending pages of strong proof showing the customer was a baldfaced lying thief)
- Aeolun 5y agoI’m just not sure what to think about practices surrounding these chargebacks any more. When I was working at a company where they were a thing, I don’t think we ever lost one. Does the whole thing just depend on who you are friends with? Or does anyone actually look at the proof you send?
- meylis 5y agoDead Justuseapp were all of functions suspended for now? I can't make a payment with your card for now :(
- dubcanada 5y agoTo be completely honest it could be that having Top Free Best Selling Streaming Softwares Tv Softwares VPN Softwares IPTV Softwares Movies Softwares Job Softwares Editing Softwares Crypto Softwares Kodi Tv Softwares Video Editors As categories could trigger some red flags, half of those are extremely risky categories. It's also not really obvious what you offer and some low paid scanner person reviewing your site for information probably had no idea what you do but saw VPN, Crypto, streaming, etc and said no.
- burlesona 5y agoIt’s disappointing that they didn’t give you a clear explanation, but it seems like the second email is saying their humans looked at your business model, issue US cards to consumers all around the world so they can manage subscription spend - and, implicitly, so they can dispute charges or cut off cards as a way to stop paying a shady subscription service - is high risk and Stripe doesn’t want to do it. I can understand that point of view. What I don’t understand is why they couldn’t write a clear email explaining their position so you would actually know what’s up.
- ceejayoz 5y ago> What I don’t understand is why they couldn’t write a clear email explaining their position so you would actually know what’s up. In some cases, it’s forbidden by law to reveal to someone that they’ve been flagged for money laundering. https://www.law.cornell.edu/cfr/text/31/1020.320 https://www.law.cornell.edu/cfr/text/31/1020.320 > No bank, and no director, officer, employee, or agent of any bank, shall disclose a SAR or any information that would reveal the existence of a SAR.
- deleted 5y ago[deleted]
- jeroenhd 5y agoOfftopic but I'm amazed you can legally hand out free (virtual) credit cards like these without anything close to a banking license. The sales pitch, to pay for services anonymously, would make it trivial to use this service for money laundering. I hope the website is lying about how private those transactions really are. I'm also a little sketched out by the fact the business resides in Wyoming while the person writing the blog says that Stripe wasn't available "in my country". The company has two directors, both of which are a vague "Cloud Peak Law" company which owns a bunch of unrelated LLCs, but no reference to any foreign owners. That's not very confidence inspiring either, in my opinion. I can find a similarly named company from Nigeria but there's no clear connection between the two. Edit: the company's Cloud Peak Law P.C. "director" is a service used by a Wyoming company set up specifically to allow anonymous registration of a business, set up there specifically because anonymous businesses are allowed by the state. I wouldn't be surprised if one of this law company's other clients used their anonymous-business-as-a-service for something sketchy, causing Stripe to go up the chain and mark the entire Cloud Peak Law "person" as unreliable and disputed. After all, going by the public record, the company is actually run by this law company, not the person writing this blog post. That may be why Stripe is able to claim a dispute that doesn't exist in their own management system. I don't know if that's the reason, of course, because there's little transparency from other side here. I don't think Stripe should be lying about the nonexistent disputes, but if I were to design a money laundering detection algorithm, this kind of stuff is exactly what I would watch out for. I'm guessing Stripe's machine learning triggered on this company and that they just picked a random TOS bullet point to end the contract by knowing that you won't be able to sue them for it anyway.
- avnigo 5y ago> I'm amazed you can legally hand out free (virtual) credit cards like these without anything close to a banking license As far as I understand it, a lot of those work like VISA gift cards.
- Chilinot 5y agoI'm not entirely sure how you would launder money through this service. From what i can tell no money is actually passed through it. It just generates a temporary credit card which is never billed. It is just used to bypass the "please enter your credit card for this free trial" prompts.
- avvt4avaw 5y agoBuddy, your business is selling "privacy cards" and "virtual cards" which hide the identity of the person making the transaction. It's a massive money laundering red flag, it's not at all surprising that Stripe doesn't want to deal with you.
- hienyimba 5y agoPrivacy cards means the cards protect the user's real cards not their identity. If you have ever been hacked or cannot cancel a renegade subscription, you would quickly grasp the need for Privacy cards.
- ddtaylor 5y agoGym memberships are notorious for this, btw.
- ceejayoz 5y agoSaid gym memberships tend to be because you signed an annual contract, with specific requirements to cancel early. Using one of these one-time-use cards won't get you out of the debt itself, and these sorts of gyms will happily wreck your credit by sending it to collections.
- Macha 5y agoI've heard of some cases where the contract auto-renews and requires an in-person presence during a limited time window to cancel when they're quite busy. While I'm sure these places have it in their terms, just making someone sign a contract to agree to it doesn't make it not-unethical or not worth criticising. It just makes it "not illegal in some jurisdictions"
- ceejayoz 5y agoI certainly agree on the ethical front. On the "use a privacy.com temporary card" front, the problem is functional, not ethical. They will sue you or send you to collections over the debt.
- 0des 5y agoAs someone with a pre-launch SaaS who just signed up for Stripe, reading this has me shook up a little bit. I'm Stripe-integrated for payments, and poised to go through Stripe Atlas soon, or at least I was.. Now I have no idea what to do. I know that OP's story isn't spotless, but what if it's my thing that gets in this situation too? I wish I could say I'm joking but I don't need this right now, I'm ~90 days out from launch, I should be tweaking final touches, not building just-in-case backup integrations with other processors.
- chrisandchris 5y agoComment from tyingq: > I have a hunch their main concern is this kind of marketing on your site: „Access the American market Our credit card comes with a U.S. billing address, so you can unlock features restricted to the U.S or Western markets especially if you don't live there." https://justuseapp.com/free-trial-card https://justuseapp.com/free-trial-card
- 0des 5y agoI saw this, and even though my thing is nowhere near what OP is doing, the amount of what-ifs going through my mind right now is causing undue concern. My SaaS is a podcast host, what if someone I'm hosting says something "wrong" in their show description and Stripe's algo doesn't like it? Edit: There's a lot on my mind right now, editing to stop for a moment and say thank you, your comment is somewhat reassuring which is what I think your intention was.
- fragmede 5y agoThink about it from their point of view. Stripe's algo isn't going to go into your platform and investigate podcast guests political opinions - that's some AGI level-5 self-driving car stuff if their automated flagging system could do that. No, their algo is gonna look at the credit cards your system is sending them, how much and how frequently you're charging them, and how much that looks like you're doing bad things (like stealing money from people). From your very limited description, you're totally in the clear.
- donohoe 5y agoI can easily see this happen and I'm sure its affecting many others too and you just don't hear about it. A couple of years ago I was unable to make some online purchases with my debt card. It was always vendor specific and there didn't seem to be any logic to it. I talked to my bank, and they talked to MasterCard, and I would speak with vendors technical support or billing. Nothing out of the ordinary. This was happening for over a year and I got by with using a credit card as needed (which I don't like to use in general). Anyway, the common denominator was all these vendors used Stripe for payments. I email Stripe and eventually someone noted that my card number had been flagged by some algorithm in the past and had been blacklisted. For background, to my current knowledge, I've never had an issue with identity-theft, had others fraudulent charge my account, or done anything out of the ordinary. That fact that this happens, and you have no notification or no clear recourse is frustrating. To be clear, I do not think this is specific to Stripe - I think all large services are vulnerable to this.
- artembugara 5y ago1. I find the title misleading 2. Stripe did not say "someone asked for a dispute" 3. Stripe banned your app for not being low-risk. And why not? They have the right to decide for themselves To me, Stripe is showing an outstanding support overall. You can even ping anyone on Twitter or send an email, and they respond. I really don't understand why so many HN users are so freaked out. And yeah, it's not a great case of support by Stripe right here. But guess what, thy don't care about you anymore, so they'll dedicate their time to existing/potential clients.
- rushiadhida 5y agoStripe acting up has been issues for a long time now.
- collision 5y agoJohn from Stripe here. Very sorry about this -- looking into it now.
- vdddv 5y agoKudos for stepping in. But you should really have a process in place where the CEO does not have to look into it based on the issue being posted on Hacker News.
- edwinwee 5y agoEdwin from Stripe here. (OP, I've just sent you an email and we can talk more over there—I'm terribly sorry for the trouble.) I can't get into too many specifics about an individual business publicly, but unauthorized charges have high potential to be disputed in the near future—and while Stripe itself doesn't have a dispute threshold, the card networks require businesses to keep disputes low. Although that email in the post was admittedly a template, a human did review the transaction activity and actively sent the email. We're digging more into exactly what happened here to prevent the confusion from happening again. Over the past few weeks, we've been overhauling how we work with businesses in situations like these and are rolling out some meaningful improvements soon.
- ddtaylor 5y agoSo, if I want to disrupt a competitor all I have to do is hire a bunch of darknet identify thieves and you'll shut down their merchant account?
- gilrain 5y agoYes, if you’re willing to break the law and risk the consequences, you can get up to all sorts of stuff. Same as anything? Like, “So, if I want to disrupt a competitor, all I have to do is hire thugs to smash all their stuff?” Yeah, that’d do it. Good luck.
- qaq 5y agoRisk is relative thing the activity has to cross threshold for the appropriate gov entity to investigate and since they are swamped that threshold keeps going up.
- MichaelApproved 5y agoI think the point is that this attack vector can be pretty anonymous and absolutely deadly to the target company. This attack is also not protected by insurance, like someone setting fire to your office would be. It’s fair to explore just how vulnerable a company can be to this type of attack from a malicious competitor.
- pc 5y ago(Stripe cofounder.) Ugh, apologies. Something very clearly went wrong here and we’re already investigating. Zooming out, a few broader comments: * Unlike most services, Stripe can easily lose very large amounts of money on individual accounts, and thousands of people try to do so every day. We are de facto running a big bug bounty/incentive program for evading our fraudulent user detection systems. * Errors like these happen, which we hate, and we take every single false rejection that we discover seriously, knowing that there’s another founder at the other end of the line. We try to make it easy to get in touch with the humans at Stripe, me included, to maximize the number that we discover and the speed with which we get to remedy them. * When these mistaken rejections happen, it’s usually because the business (inadvertently) clusters strongly with behavior that fraudulent users tend to engage in. Seeking to cloak spending and using virtual cards to mask activity is a common fraudulent pattern. Of course, there are very legitimate reasons to want to do this too (as this case demonstrates). * We actually have an ongoing project to reduce the occurrence of these mistaken rejections by 90% by the end of this year. I think we’ll succeed at it. (They’re already down 50% since earlier this year.)
- buf 5y agoThis post reminds me of when the same thing happened to me about 5 weeks ago: https://news.ycombinator.com/item?id=28085706 https://news.ycombinator.com/item?id=28085706 It feels like there should just be a better process. Shut down payments to protect yourselves sure, but spare a real life person to email the customer and give them a chance to explain or at least understand why.
- GiorgioG 5y agoIt seems like companies can't seem to get their act together to offer some kind of rapid escalation/remediation service. Maybe it's time for legislation to force their hand. This could potentially cost a business a ton of money (and affect a non-trivial number of employees) in the process.
- mgkimsal 5y agoWould 'paid' support help? Like pay, say... $150 up front, which is refunded (partial or all) depending on the outcome (error on their end, you get refunded?) It runs the risk of turning 'support' in to a profit center, I support.
- KingOfCoders 5y agoLast time I've said this, I got -10 Karma, we'll see what you can do now. Over time every payment provider will become Paypal because of outside forces.
- OliverJones 5y agoThe automated email from Stripe is just weird. No, zero, disputes? That's uncanny. I've run a Stripe.com integration (for a SaaS business). A few times a year somebody disputes a charge. It's usually because they looked at their payment card statement and didn't recognize us when we billed for renewal. Our policy is 1) try to resolve the dispute in our favor. That mostly works. It's good for our reputation score on Stripe. 2) refund the customer's charge. Always. 3) contact the customer and ascertain whether they want to continue their subscription. I don't understand zero disputes. That's just not feasible when dealing with the public.
- Tomte 5y agoWelcome to the Stripe support forum! No, I don't blame you for trying and I'm glad you've got attention, but don't people think it should be possible for all those founders, CEOs and other Stripe luminaries to trawl their own support channels?
- go_blue_13 5y agoDo you have an issue with them reading HackerNews and responding to a relevant post? Its not feasible for the CEO of a huge company to review every support ticket, no
- Tomte 5y agoThis happens all the time. Go search for Stripe problems here.
- deleted 5y ago[deleted]
- jbschirtzs 5y agoI had the same thing happen to our church. I do not believe this is an "Accident". You can read the blow by blow at https://www.jbschirtzinger.com/post/stripe/ https://www.jbschirtzinger.com/post/stripe/ You can see very clearly that I also thought this was an automated issue, but turned out not to be.
- cantbeserious 5y ago> What I can tell you, unequivocally, as that these are the End of Days and whatever it is you are here doing it is more consistent with a discriminatory policy of something like the Anti-Christ than anything actually just. This might be the craziest thing I've ever seen in a support email.
- jbschirtzs 5y agoIf you have a more rational explanation for all the craziness happening, I'm all ears, pal.
- koreanguy 5y agodon't use stripe, they withhold your funds and customer funds.
- hienyimba 5y agoUPDATE from Justuseapp.com: Stripe has reached out to us and working together, we have resolved this issue and our account has been re-enabled. I cannot thank Hacker News enough. Running a business all these years has been hard and full of Ups and downs. I do not recommend it for the faint-hearted. Until this morning, I had almost given up hope that our business was dead. Thanks for bringing us back from the dead HN.
- _hilro 5y agofrom https://news.ycombinator.com/item?id=28524077 https://news.ycombinator.com/item?id=28524077 > it looks like JustUseApp was collecting money for the virtual cards by pushing through unauthorised payments to the users original card. > Additionally in the EU, the introduction of Strong Customer Authentication basically makes these types of transaction completely illegal Was this the case?
- hienyimba 5y agoNo it wasn't. All payments must be manually authenticated. I have replied the parent comment.
- avianlyric 5y agoReading between the lines here, and based on the reply from Edwin in this thread, it looks like JustUseApp was collecting money for the virtual cards by pushing through unauthorised payments to the users original card. So payment using their privacy card would look a little like this. Merchant --> Privacy Card --> Users Real Card --> Users Bank Where the step between Privacy Card and Real Card doesn't involve a checkout process and transaction authorisation. In bank speak they're just presenting transactions to the users bank, without first getting a transaction authorisation. These details are important because presented transactions can't be stopped (that's what authorisation is for), they immediately move money from the users bank to the merchant, regardless of available funds or user consent, they can only be reversed via chargeback. These types of payments are called unauthorised payments, and due to the inability of bank to prevent, you're never really meant to use them, and the receiving bank has very strong rights during the chargeback process. As a payments processor on the other side of the card network you don't want to be dealing with unauthorised payments. They're trivial to dispute, you're almost certainly breaking the card networks rules, and when they go wrong (which they 100% will), they're extremely expensive and time consuming to deal with. Additionally in the EU, the introduction of Strong Customer Authentication basically makes these types of transaction completely illegal, and as a customer if such a transaction happened on your account you would have a right to full refund in the event of dispute, and your bank would be forced to provide it even if you had published your full card details online. You're bank would of course then go after the merchant via the card network, and then payment processors like Stripe get caught in the middle, and potentially find themselves liable for money they can no longer reclaim from the merchant, because they've already paid out the money and the dispute only happened 3 or 4 months later.
- hienyimba 5y agoYour prognosis is not quiet correct. Users have to manually fund their cards. This takes care of all the issues you mentioned above.
- Crazyontap 5y agoWhat scares me most is what happens when this happens to you and you can't get to the HN front-page? Will you get the same resolution from Stripe/Google/Apple/Aws if it didn't? Making the front-page is often random luck I think, which is also why I personally always upvote such submissions when I find the person making it is a solopreneur/small company - as this may be their last and final resort to get things sorted.
- nathanyz 5y agoAm I correct that the Free Trial Card would essentially allow your users to generate a new credit card so that they can repeat a service's free trial period over and over and never have any intention of actually paying? I know there are other uses as well, but could definitely see this service being a magnet for users who intend to defraud the actual services where these cards are being used.
- fxleach 5y agoWorked for a supplement company that was forced out of business by Stripe these same reasons. Just wasn't enough time to integrate a whole new payment system when they shut us down.
- redleggedfrog 5y ago"...a company Stripe recently invested in." Seems like you're competing against your provider. Good luck with that.
- deadalus 5y agoStripe is company that boots people off due to their political positions[0]. I would be very careful while doing business with them. A few bad news reports and you are gone[1]. [0] https://techcrunch.com/2021/01/10/stripe-reportedly-joins-the-tech-platforms-booting-president-trump-from-their-services/ https://techcrunch.com/2021/01/10/stripe-reportedly-joins-th... [1] https://reclaimthenet.org/laura-loomer-gets-banned-from-payment-processor-stripe/ https://reclaimthenet.org/laura-loomer-gets-banned-from-paym...
- iconjack 5y agoAlso, censored.tv.
- kayodelycaon 5y ago> 0: Sources told the Journal that the reason for the company’s decision was the violation of company policies against encouraging violence. Seems like a valid reason to ban someone from a platform. Reading further, Stripe was being used to collect money to make hundreds of frivolous lawsuits. (Legal definition thereof) > 1: The latest payment platform to refuse to accept payments made to Loomer is Stripe. Looks like Stripe is far the first company to do this. Reading between the lines, this person is specifically trying to get banned to prove a point. At some point, their history of doing so becomes the reason for kicking them off, rather than their political views.
- thatha7777 5y agoOP, I symphatize with your pain. I've been trying to get approved for Stripe Issuing for 4+ months now. I have been "approved" multiple times, but the Issuing-related features never get turned on. Every time I complain, there's another review cycle. The most kafkaesque experience I have had with a business.
- StLCylone 5y agoSounds exactly like Stripe and PayPal. Arbitrarily turn you off anytime they feel like it for any reason they please. Never build your whole business on using either or you are just a daily dice throw from being turned off. The difference between you and TrueBill or Ramp is they have legal teams and founders/backers that have inside access and special approvals that ordinary start ups do not. Certain start ups get special treatment by the banks and payment processors because of behind the scenes actions you cannot take. Banks and payment processors currently have the power to decide which companies can exist and which cannot. Sometimes for perceived moral or risk reasons and sometimes for random reasons. We really could use some sort of uniform legal appeals process rather than the standard of going to social media to beg for reinstatement.
- WhompingWindows 5y agoThis reminds me of the false-positive vs false-negative dilemma faced in medical testing. Either you optimize for low cost and convenience, or for catching true-positives or true-negatives. For HIV testing for instance, if someone does test HIV-positive falsely, their changed safer behavior in the short-term wouldn't harm anyone, and follow-up tests could catch that they're actually negative. But if we falsely say someone does not have cancer, when they do, it could grow a lot in the short-term before symptoms arise and another test is given. They may also use a lot of unnecessary care trying to diagnose the issue after that false-negative cancer test. What's the right solution? It's case by case, down to a mixture of morality and expertise to decide. Seems these tech algorithms often generate a lot of false-positives wrongfully, or that's what's posted online afterwards. It'd be interesting to dig into the numbers for various platforms, see if they're falsely negative for spam accounts and bad actors. We wouldn't hear posts on HN about spam bots that cut into FB's bottom line, would we?
- ryan29 5y ago> What's the right solution? It's case by case, down to a mixture of morality and expertise to decide. I think the idea of minimizing harm is a really good one. I've never done any machine learning type stuff, but, based on my limited understanding, I think there are probably a few issues at play that make things difficult. I think the feedback loop for an algorithm is likely important. If you're training an algorithm to match fingerprints, you have a few things that work in your favor. First, matching is easier with fewer samples, so you can train the model incrementally with larger and larger data sets. Second, the process of identifying false positives is easy, relatively definitive, and isn't influenced by external factors. If the ML algorithm only has X% confidence you send it to a human who assesses the match and tells the algorithm the answer so it can "learn" for the next situation that's similar. Contrast that with something like payment processing. First, you need to scale with demand and it's not easy to incrementally train the algorithm. Second, false positives don't have a tight feedback loop. A false positive negatively affects a customer and every case is different. You need to rely on external, subjective data that isn't definitive enough to be useful to an algorithm (IMO). I think matching fingerprints is a good analogy to illustrate some of the problems, especially when you hear things along the lines of "looked too similar to fraudulent activity." With fingerprints, you could give 10 to an amateur and they could probably match them accurately. Scale that up to 10,000 and you have so many that look similar, but not identical and you need a professional to do the matching. I think ML is similar. It's better on a small scale than it is on a large scale and just doesn't scale up as well as the sales pitch says (unless it's assessing problems with definitive solutions). The issue here is that tech companies are treating ML like it scales in a linear fashion. Just throw more compute at it and 10x the scale, right? Wrong (IMO). There was another comment here that said something along the lines of getting to 98% accuracy and deciding not to serve the other 2%. I think that's what's happening everywhere, but rather than explicitly telling customers they're not welcome, companies are simply letting their ML algorithms run to find the equilibrium where they can manage the "not positive" rate. And that goes back to your idea of minimizing harm. They don't want to. They don't care if they promise you service even though you're borderline in terms of triggering false positives. You're part of the data set for their machine learning algorithm and that means you're viewed as acceptable collateral damage. They'll ruin your life to train their ML algorithm(s).
- Fnoord 5y agoMy bank (Bunq) also has virtual cards and allows to track subscriptions. Pretty nice to have. It doesn't have an easy option to cancel subscriptions though, but I actually don't need that to be honest. Still, nice niche idea. Interestingly, because you can get these debit cards and IBANs with the subscription, Bunq is often used by money mules and the like, giving Bunq a bad name in the process. Wouldn't surprise me if something similar happened here, even if just as a preventive measure. I do think its strange Justuseapp.com allows people to get a virtual debit card with an address in USA, even when they're not in USA (their customer). Either way, if you're using this ("financial VPN based in USA") to steer away from US government you're doing it wrong. A proper use case would be to avoid PII getting leaked on all kind of online services.
- at_a_remove 5y agoI know machine learning rules us all now, with blackbox algorithms handing down Brazil-worthy decisions, but I would like to understand how there was not an extremely basic function at the end, as a sanity check, that would SELECT from some table marked MiscreantEvents WHERE Infraction = 'PaymentDispute', totals them up, and then offers that as a comparison against the "Too Many Payment Disputes" that has gotten barfed out of said Byzantine black box? Surely if that number is zero that would be an excellent sanity check.
- rajeevk 5y agoThe next priority in my project is to integrate payment. I decided to use Stripe. Given this, now I think I should review my decision. I am checking with HN users, what alternatives are out there and what is your experience with them.
- drummer 5y agoCryptocurrencies will solve this problem very soon. Middlemen are cancer. Ask Satoshi.
- technick 5y agoCheck out Recurly as a alternative to Stripe. recurly.com
- burnte 5y agoI had my Square account cancelled a couple of years ago for no descernable reason. I'd never had a chargeback or dispute, just one day I got an email saying they "couldn't" be my processor anymore. Zero reply to emails.
- idworks1 5y agoI feel for everyone who isn't a good writer and doesn't succeed in getting featured on HN homepage. (writing > coding) Realistically, we need automation to handle most cases. But that means false positives. And their needs to be a better channel than HN or being famous on twitter to get issues resolved.
- kureikain 5y agoNot exact this but I had my account in some suspend state twice saying I was on Match list https://news.ycombinator.com/item?id=26320429 https://news.ycombinator.com/item?id=26320429 https://news.ycombinator.com/item?id=21306225 https://news.ycombinator.com/item?id=21306225 In both case Edwin has helped me a lot to recover my access. But it's a hear sinking moment and a few anxiety days because without Stripe I don't really know what option I had out there. Paypal is probaly what I will do next in those case. PS: if you're here Edin, thanks so much for helping me solve those issue in the past. I finally be able to bootstrap by SaaS and profitable with it.
- diebeforei485 5y agoIf you cancel somebody's merchant account, give them a phone number to call. It's not that complicated.
- amluto 5y agoOn a related note: Stripe, have you considered tackling the customer side of fraud at all? I recently had an obviously fraudulent Stripe transaction on my credit card statement (questionable storefront that disappeared shortly after I placed my order). My only recourse was to dispute the charge with my bank. The transaction on my statement showed “STRIPE” and not a comprehensible merchant. Has Stripe considered having a link on the main page for questions about a charge? If I could have typed in charge details and gotten direct confirmation that the merchant account was closed for fraud (I bet it was) and that I could ask online for my money back, it would have saved me a phone call, saved Stripe a chargeback, and earned a bit of goodwill.