7 ms·

> Our app for some reasons was creating new subscriptions from old accounts that was canceled or disabled a long time ago. If I cancel or disable my account fo

> Our app for some reasons was creating new subscriptions from old accounts that was canceled or disabled a long time ago. If I cancel or disable my account for a service I don't expect them to be able to charge me money in the first place! Are they keeping card authorisations (or direct debit mandates, or whatever other mechanism) for customers that don't even have an account with them any more? That sounds like an... ...interesting way to do business, but perhaps I'm misinterpreting this.

avianlyric 5y ago
They don’t need to keep anything. The card details will be stored with Stripe, if they don’t actively tell Stripe to delete those details then they’ll be able to create a new subscription and charge the card. For the vast majority of cases all you need to charge a card is the 16 digit number on the front and an expiry date. Pretty much everything else is optional (CVV, Name, Address etc), but opens you up to stupid levels of liability in the disputes process if you didn’t include it in the original payment request.
- sbierwagen 5y ago
  Card issuer risk model heuristics will also apply different amounts of scrutiny based on transaction size and type. You could do a two dollar transaction just with card number, I wouldn't expect a twenty thousand dollar transaction to go through without the other fields.
  - ineedasername 5y ago
    Yes-- at my local suoermarket a small purchase will just go through, while a larger one (~$25 is the threshold) requires a signature.
    - sofixa 5y ago
      A signature? I'm sorry, are you from the past? Joking aside, I don't see how a signature is of any use provides your card is supposed to have yours on the back, so anyone having your card has your signature too. PINs have been a thing since I've had a card (2011), and I don't see why anyone still relies on signatures for card authentication. The way things work in developed countries is the following - payments under 30,50,100 euros (depending on the country) are contactless where you just tap your card on top and it's done, and for more you have to insert the card and type your PIN. Or you can just use your phone for any amount by tapping it.
      - SnowflakeOnIce 5y ago
        > A signature? I'm sorry, are you from the past? No, the US :) Signatures are still common enough when paying with a card in the US, for whatever reasons.
      - cpursley 5y ago
        It's not a joke, US payment systems are hot garbage (as are bank apps). Much if the rest of the world has been doing contactless payment for 5 years already.
- MBCook 5y ago
  Agreed. I’d go as far as to say they were irresponsible to not tell Stripe to delete/deauthorize the tokens. In fact, why does any customer in their database have ANY connection to Stripe after they’ve canceled? I haven’t used stripe but I’m guessing there’s some sort of customer ID/token. If they’ve canceled why are you retaining that? So that’s two things. Even if the code encountered a bug like they did here, it shouldn’t of been possible to actually trigger a new subscription.
  - jahewson 5y ago
    Stripe offers a billing product that serves as a source of truth for the entire subscription lifecycle. Companies are legally required to maintain financial accounts and nowadays accountants can even do your reporting using the data directly from stripe. What’s happening here is that there’s a user who has a card on file and a cancelled subscription, and an erroneous new subscription is being created under that user. Whether or not it makes sense to remove the card from the user account depends on whether or not that user could meaningfully have multiple subscriptions or expect to renew in the medium-term future.
FanaHOVA 5y ago
The Ruby 1.9 hash syntax was the first red flag honestly... :P
- loktarogar 5y ago
  "old" hash syntax is still necessary for things where the key isn't a symbol - which was the case for 1 of the hashes
Ozzie_osman 5y ago
It's unclear whether by canceled they mean the account was canceled or the subscription was canceled. As a user, if I delete my account, I'd definitely expect my payment details gone. However, if I just disable my subscription, I'd expect they keep my payment details on file in case I reactivate.
eknkc 5y ago
If I delete an account yes but if I simply unsubscribe from a paid service I actually expect them to store any billing info in case I want to resubscribe. Should be a single click operation.

avianlyric 5y ago

They don’t need to keep anything. The card details will be stored with Stripe, if they don’t actively tell Stripe to delete those details then they’ll be able to create a new subscription and charge the card. For the vast majority of cases all you need to charge a card is the 16 digit number on the front and an expiry date. Pretty much everything else is optional (CVV, Name, Address etc), but opens you up to stupid levels of liability in the disputes process if you didn’t include it in the original payment request.

sbierwagen 5y ago
Card issuer risk model heuristics will also apply different amounts of scrutiny based on transaction size and type. You could do a two dollar transaction just with card number, I wouldn't expect a twenty thousand dollar transaction to go through without the other fields.
- ineedasername 5y ago
  Yes-- at my local suoermarket a small purchase will just go through, while a larger one (~$25 is the threshold) requires a signature.
  - sofixa 5y ago
    A signature? I'm sorry, are you from the past? Joking aside, I don't see how a signature is of any use provides your card is supposed to have yours on the back, so anyone having your card has your signature too. PINs have been a thing since I've had a card (2011), and I don't see why anyone still relies on signatures for card authentication. The way things work in developed countries is the following - payments under 30,50,100 euros (depending on the country) are contactless where you just tap your card on top and it's done, and for more you have to insert the card and type your PIN. Or you can just use your phone for any amount by tapping it.
    - SnowflakeOnIce 5y ago
      > A signature? I'm sorry, are you from the past? No, the US :) Signatures are still common enough when paying with a card in the US, for whatever reasons.
    - cpursley 5y ago
      It's not a joke, US payment systems are hot garbage (as are bank apps). Much if the rest of the world has been doing contactless payment for 5 years already.
MBCook 5y ago
Agreed. I’d go as far as to say they were irresponsible to not tell Stripe to delete/deauthorize the tokens. In fact, why does any customer in their database have ANY connection to Stripe after they’ve canceled? I haven’t used stripe but I’m guessing there’s some sort of customer ID/token. If they’ve canceled why are you retaining that? So that’s two things. Even if the code encountered a bug like they did here, it shouldn’t of been possible to actually trigger a new subscription.
- jahewson 5y ago
  Stripe offers a billing product that serves as a source of truth for the entire subscription lifecycle. Companies are legally required to maintain financial accounts and nowadays accountants can even do your reporting using the data directly from stripe. What’s happening here is that there’s a user who has a card on file and a cancelled subscription, and an erroneous new subscription is being created under that user. Whether or not it makes sense to remove the card from the user account depends on whether or not that user could meaningfully have multiple subscriptions or expect to renew in the medium-term future.

FanaHOVA 5y ago

The Ruby 1.9 hash syntax was the first red flag honestly... :P

loktarogar 5y ago
"old" hash syntax is still necessary for things where the key isn't a symbol - which was the case for 1 of the hashes

Ozzie_osman 5y ago

It's unclear whether by canceled they mean the account was canceled or the subscription was canceled. As a user, if I delete my account, I'd definitely expect my payment details gone. However, if I just disable my subscription, I'd expect they keep my payment details on file in case I reactivate.

eknkc 5y ago

If I delete an account yes but if I simply unsubscribe from a paid service I actually expect them to store any billing info in case I want to resubscribe. Should be a single click operation.