10 ms·

Stripe Radar is good but some of the features (fail on bad CVV) seem like they should come out of the box.

by jamesfinlayson 4y ago

sgc 4y ago
That is insane. The CC issuers should force them to do that.
- jibe 4y ago
  The annoying thing is that the issuer started the problem in the first place. Someone enters a credit card and a bad CVV, Stripe sends it to the bank for validation, it fails, but the bank approves the charge anyway. Now you have an approved charge with a bad CVV. The bank punted the problem back down to Stripe, and Stripe punts it to you to figure out.
  - pbhjpbhj 4y ago
    If the bank approves the charge how did this end up being the retailers problem? The bank said they would pay it despite the details not being valid, they surely take on the risk in law ... how else would it work and remain logical?
    - jibe 4y ago
      You’d think so, but if the charge does end up being fraudulent, and customer charges back, not only are you on the hook for the full charge, plus processing fees, plus a $15 dispute fee/penalty. It is why I also cringe when people chargeback before they ask for refunds. The system is stacked against the retailer.
- jhugo 4y ago
  That assumes it's a zero-cost decision. It's extra friction in the payment process (the CVC must be entered and must be entered correctly) which has a non-zero impact on genuine transactions. They "should" only force it if its benefits exceed its costs. According to a sibling comment from someone at Stripe, they reduce genuine revenue by more than they reduce fraud costs.
edwinwee 4y ago
(Edwin from Stripe here.) Stripe CVV verification can be turned on with a click or two in the Dashboard (https://dashboard.stripe.com/radar/rules https://dashboard.stripe.com/radar/rules). (The card issuer automatically also does their own verfication, and they can choose to decline or approve based on their own logic.) But the effectiveness really depends on the type of business. We have it off by default because we found it improves payment acceptance rates for businesses by 0.08% on average—with no tangible effect on fraud. Basically, Stripe Radar ML fraud detection would catch the fraudster anyway. So we thought businesses could use the small bump in revenue.
- mchusma 4y ago
  We ran various tests with radar. For us, radar universally costs us more than it saves in fraud. The one time we got hit hard by a fraudster, radar was on but failed to catch them. stripe ended up refunding radar fees because it was so obviously fraud. Frustrating experience. Radar would probably make sense at 1/10th the price. Nice layer, but very expensive for the value.
  - danpalmer 4y ago
    I seem to remember that we just never tried it because we knew that the cost of fraud was <5c per order. I think it only makes sense for certain types of business. For retail at <$200-$400 AOV, it didn’t make sense. Maybe for <$100 it might make sense to deter testers, and maybe for much higher values it might due to the risk.
  - jamesfinlayson 4y ago
    Sounds about right - Stripe's default fraud detection is pretty good I think but putting the useful features behind a $0.02 per transaction cost is a bit annoying.
- leafo 4y ago
  I'm curious, you folks probably make money off of fraud right? You probably have negotiated whatever dispute fee you pay processors directly well below the $15 you pass on to sellers, pocketing the difference. So I'm guessing that Radar's price was set with this in mind, you ran the regression to set a price to ensure revenue does not decrease by having better fraud detection. Hence the super expensive price. If this wasn't the case, Radar probably would be free. Probably creates a really bizarre incentive. You don't want to deal with obvious scams that hurt processing reputation, but you probably also want to make your built in fraud detection just crappy enough to ensure you capitalize on that revenue.

Stripe Radar is good but some of the features (fail on bad CVV) seem like they should come out of the box.

sgc 4y ago

That is insane. The CC issuers should force them to do that.

jibe 4y ago
The annoying thing is that the issuer started the problem in the first place. Someone enters a credit card and a bad CVV, Stripe sends it to the bank for validation, it fails, but the bank approves the charge anyway. Now you have an approved charge with a bad CVV. The bank punted the problem back down to Stripe, and Stripe punts it to you to figure out.
- pbhjpbhj 4y ago
  If the bank approves the charge how did this end up being the retailers problem? The bank said they would pay it despite the details not being valid, they surely take on the risk in law ... how else would it work and remain logical?
  - jibe 4y ago
    You’d think so, but if the charge does end up being fraudulent, and customer charges back, not only are you on the hook for the full charge, plus processing fees, plus a $15 dispute fee/penalty. It is why I also cringe when people chargeback before they ask for refunds. The system is stacked against the retailer.
jhugo 4y ago
That assumes it's a zero-cost decision. It's extra friction in the payment process (the CVC must be entered and must be entered correctly) which has a non-zero impact on genuine transactions. They "should" only force it if its benefits exceed its costs. According to a sibling comment from someone at Stripe, they reduce genuine revenue by more than they reduce fraud costs.

edwinwee 4y ago

(Edwin from Stripe here.) Stripe CVV verification can be turned on with a click or two in the Dashboard (https://dashboard.stripe.com/radar/rules https://dashboard.stripe.com/radar/rules). (The card issuer automatically also does their own verfication, and they can choose to decline or approve based on their own logic.) But the effectiveness really depends on the type of business. We have it off by default because we found it improves payment acceptance rates for businesses by 0.08% on average—with no tangible effect on fraud. Basically, Stripe Radar ML fraud detection would catch the fraudster anyway. So we thought businesses could use the small bump in revenue.

mchusma 4y ago
We ran various tests with radar. For us, radar universally costs us more than it saves in fraud. The one time we got hit hard by a fraudster, radar was on but failed to catch them. stripe ended up refunding radar fees because it was so obviously fraud. Frustrating experience. Radar would probably make sense at 1/10th the price. Nice layer, but very expensive for the value.
- danpalmer 4y ago
  I seem to remember that we just never tried it because we knew that the cost of fraud was <5c per order. I think it only makes sense for certain types of business. For retail at <$200-$400 AOV, it didn’t make sense. Maybe for <$100 it might make sense to deter testers, and maybe for much higher values it might due to the risk.
- jamesfinlayson 4y ago
  Sounds about right - Stripe's default fraud detection is pretty good I think but putting the useful features behind a $0.02 per transaction cost is a bit annoying.
leafo 4y ago
I'm curious, you folks probably make money off of fraud right? You probably have negotiated whatever dispute fee you pay processors directly well below the $15 you pass on to sellers, pocketing the difference. So I'm guessing that Radar's price was set with this in mind, you ran the regression to set a price to ensure revenue does not decrease by having better fraud detection. Hence the super expensive price. If this wasn't the case, Radar probably would be free. Probably creates a really bizarre incentive. You don't want to deal with obvious scams that hurt processing reputation, but you probably also want to make your built in fraud detection just crappy enough to ensure you capitalize on that revenue.