4 ms·
I had a significant (to me) amount of EFT fraud that happened because of Stripe. Using Stripe Connect, I had a health-related marketplace application, and purpo
by briandear 3y ago
I had a significant (to me) amount of EFT fraud that happened because of Stripe. Using Stripe Connect, I had a health-related marketplace application, and purported sellers would set up their bank account for EFT transfers -- and the bank accounts were CashApp accounts (technically the Cash App banking partner but still controlled by CashApp.) They then used stolen credit cards to "buy" services from themselves. Then the funds from the stolen cards would be transferred via EFT to the CashApp accounts. Then the charges would be challenged and reversed and the CashApp accounts were long-since emptied. Leaving me to personally pay for the fraud reversals (and charge back fees for each of the credit card transactions.) To the tune of over $27k.
Contacting Stripe about this (this was about 2 years ago) -- apparently this was all my fault -- despite CashApp "bank" accounts being bastions of fraud, and the credit card transactions all being from a single IP address. And I was given the run around since it wasn't my bank account used for the EFTs, so I didn't have a "fraud" claim and the stolen credit cards weren't mine either. But I was left holding the bag. Stripe took the negative balance out of my bank account.
Basically fraud is my problem even though their systems enabled it (for real, a simple check of an account routing number shows that it's the holding bank for CashApp, yet they allowed the EFTs without even the most cursory hold) -- but Stripe for years had no problem getting my more than 3% in credit card fees. Also the transaction size was far different than the typical transaction size that occurred for multiple years. But yeah, I get it, it's all my fault.
I contacted law enforcement with extremely detailed logs, even the geographic area where the transactions happened (down to the block of a neighborhood in Florida.) I contacted Stripe, I contacted CashApp. And nobody gave a shit because it wasn't their money.
If Stripe were on the hook for the fraud, I'd bet their systems would get really good in a hurry. As it is they not only didn't have any liability, they also made money from me on the chargeback fees. And CashApp doesn't care because it isn't their money either.
I'm working on a new startup project now and Stripe is not on my list of payment processors. I will never use anything Square-related ever again either. I realize that the others probably aren't any better, but that there was no empathy (and for weeks after, attempted fraud with Cash App banks accounts continued to be attempted, but I had manually blocked transfers to that specific routing number in my application code -- so I saw the fraud attempts continue long after.)
- weird-eye-issue 3y agoYikes Basically Stripe facilitated money laundering and then left you on the hook for it while happily taking fees from you
- derefr 3y agoIt's weird that Stripe has a rule you can use to block all prepaid cards, but has no rule for blocking CashApp and its ilk. (https://www.papara.com/en https://www.papara.com/en is another one we've been dealing with.) I think of these "online wallet" services as effectively "VPNs for money": they give a fraudster who wants to get around some other form of blacklisting, as many additional credit card numbers to spread their tx volume across as they like — all with arbitrary credentials (because these cards are issued by "online banks" who never see their customers in person, so it's very easy to register accounts with purchased false identities. And people also just resell them: https://wmcentre.net/en/item/papara-vasha-turetskaya-zarubezhnaya-karta-5-tl-lichn-3574918 https://wmcentre.net/en/item/papara-vasha-turetskaya-zarubez...) If I can block Tor IP addresses in Cloudflare, why can't I block these "money VPNs" in Stripe?
- turtles3 3y agoAre there any payment processors you can recommend, especially re. fraud protection? We have started out with stripe (because the API is so damn convenient), but HN has so many stories like this were seriously reconsidering that choice. It's a shame that in every one of these threads someone from stripe steps in and promises to sort everything out for one customer, but the underlying issues never get resolved. I'm not saying that fraud is an easy problem to solve, but I think you're absolutely right that this is a case of misaligned incentives. If it were Stripe's liability, it would get solved for _everyone_, rather than being in this middle ground where if you're lucky you might get help if you post on HN