4 ms·

Stripe Radar works great for these kind of fraud. We have a SaaS service with 30-Day free trials, yet we sometimes see a subscriptions within seconds of startin

Stripe Radar works great for these kind of fraud. We have a SaaS service with 30-Day free trials, yet we sometimes see a subscriptions within seconds of starting a trial with a pasted card info - most of them are flagged for review by Stripe Radar. Most definitely worth 5 cents per transaction if you’re not on standard pricing. We’ve also disabled use of pre-paid cards because we often see subscriptions with the sole purpose of bypassing trial limitations (e.g api limit) to abuse our services. Another fraudulent scheme that’s concerning for Stripe users is someone doing chargeback after a year of subscription - banks always side with the card user (even with login logs) and Stripe dings you $15 per chargeback - unless you signed up for Chargeback Protection.

chrisseaton 4y ago
> with a pasted card info Is pasting your card info wrong? My card info lives in my password manager so yeah I paste it in.
- deleted 4y ago
  [deleted]
- pkrotich 4y ago
  I don’t believe password manager counts as a paste but Ctrl+V does… and one of the signals that the user might not actually have the card when combined with IP location of the user and issuer. In our case the card was issued by a Saudi Arabia bank but the user pasted it from Morocco.
  - chrisseaton 4y ago
    I copy and paste it out the password manager. Are you expecting your customers to literally hand-type card numbers into a website every time?
    - pkrotich 4y ago
      No I don’t have it blocked on my end - I was just referencing one of the signals Radar considers among other things (I don’t have inside info). When a charge is denied or flagged for review you can see signals used to score the risk.
  - jhugo 4y ago
    > In our case the card was issued by a Saudi Arabia bank but the user pasted it from Morocco. If you sell B2B in Morocco it wouldn't be unusual at all for some businesses to have parent companies or banking relationships in SA. Maybe in your context the countries individually are already a signal, but the combination of them is not that crazy.
- xuki 4y ago
  It's not wrong by itself, but it's a signal. Enough "signals" and the transaction is flagged for manual review.
- armchairhacker 4y ago
  Most browsers autofill the card info, idk if that counts as pasting
jamesfinlayson 4y ago
Stripe Radar is good but some of the features (fail on bad CVV) seem like they should come out of the box.
- sgc 4y ago
  That is insane. The CC issuers should force them to do that.
  - jibe 4y ago
    The annoying thing is that the issuer started the problem in the first place. Someone enters a credit card and a bad CVV, Stripe sends it to the bank for validation, it fails, but the bank approves the charge anyway. Now you have an approved charge with a bad CVV. The bank punted the problem back down to Stripe, and Stripe punts it to you to figure out.
    - pbhjpbhj 4y ago
      If the bank approves the charge how did this end up being the retailers problem? The bank said they would pay it despite the details not being valid, they surely take on the risk in law ... how else would it work and remain logical?
      - jibe 4y ago
        You’d think so, but if the charge does end up being fraudulent, and customer charges back, not only are you on the hook for the full charge, plus processing fees, plus a $15 dispute fee/penalty. It is why I also cringe when people chargeback before they ask for refunds. The system is stacked against the retailer.
  - jhugo 4y ago
    That assumes it's a zero-cost decision. It's extra friction in the payment process (the CVC must be entered and must be entered correctly) which has a non-zero impact on genuine transactions. They "should" only force it if its benefits exceed its costs. According to a sibling comment from someone at Stripe, they reduce genuine revenue by more than they reduce fraud costs.

chrisseaton 4y ago

> with a pasted card info Is pasting your card info wrong? My card info lives in my password manager so yeah I paste it in.

deleted 4y ago
[deleted]
pkrotich 4y ago
I don’t believe password manager counts as a paste but Ctrl+V does… and one of the signals that the user might not actually have the card when combined with IP location of the user and issuer. In our case the card was issued by a Saudi Arabia bank but the user pasted it from Morocco.
- chrisseaton 4y ago
  I copy and paste it out the password manager. Are you expecting your customers to literally hand-type card numbers into a website every time?
  - pkrotich 4y ago
    No I don’t have it blocked on my end - I was just referencing one of the signals Radar considers among other things (I don’t have inside info). When a charge is denied or flagged for review you can see signals used to score the risk.
- jhugo 4y ago
  > In our case the card was issued by a Saudi Arabia bank but the user pasted it from Morocco. If you sell B2B in Morocco it wouldn't be unusual at all for some businesses to have parent companies or banking relationships in SA. Maybe in your context the countries individually are already a signal, but the combination of them is not that crazy.
xuki 4y ago
It's not wrong by itself, but it's a signal. Enough "signals" and the transaction is flagged for manual review.
armchairhacker 4y ago
Most browsers autofill the card info, idk if that counts as pasting

jamesfinlayson 4y ago

Stripe Radar is good but some of the features (fail on bad CVV) seem like they should come out of the box.

sgc 4y ago
That is insane. The CC issuers should force them to do that.
- jibe 4y ago
  The annoying thing is that the issuer started the problem in the first place. Someone enters a credit card and a bad CVV, Stripe sends it to the bank for validation, it fails, but the bank approves the charge anyway. Now you have an approved charge with a bad CVV. The bank punted the problem back down to Stripe, and Stripe punts it to you to figure out.
  - pbhjpbhj 4y ago
    If the bank approves the charge how did this end up being the retailers problem? The bank said they would pay it despite the details not being valid, they surely take on the risk in law ... how else would it work and remain logical?
    - jibe 4y ago
      You’d think so, but if the charge does end up being fraudulent, and customer charges back, not only are you on the hook for the full charge, plus processing fees, plus a $15 dispute fee/penalty. It is why I also cringe when people chargeback before they ask for refunds. The system is stacked against the retailer.
- jhugo 4y ago
  That assumes it's a zero-cost decision. It's extra friction in the payment process (the CVC must be entered and must be entered correctly) which has a non-zero impact on genuine transactions. They "should" only force it if its benefits exceed its costs. According to a sibling comment from someone at Stripe, they reduce genuine revenue by more than they reduce fraud costs.