11 ms·

I Lost $210 to a Stripe Dispute Despite Proof

56 points by recroad 2y ago

lancecotingkeh 2y ago
[flagged]
- mtmail 2y ago
  The last 10 comments were all boilerplate promotion of getopenpay "Please don't use HN primarily for promotion. It's ok to post your own stuff part of the time, but the primary use of the site should be for curiosity." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - lancecotingkeh 2y ago
    Ah sorry! Thanks for flagging
    - hluska 2y ago
      You’ve been doing it for months - so long in fact that I’ve added your company to a list of companies that I won’t go near. I’m not even that devoted to this site but recognize both your name and the repetitive ways you promote your project. Remember that when you try to craft a marketing message, you have to make sure that you’re not doing damage to your brand. You have done a significant amount of damage to your brand because you don’t care about this community.
      - lancecotingkeh 2y ago
        Sorry- I just noticed this post and thought I'd comment. The HN community helped me when I got kicked off of Stripe that I thought it would be a way to give back
        hluska 2y ago
        Come on bud, I just went through your account and you have only made one comment that didn’t link to your brand. I’m sure you have other things to contribute as I’m sure you have other interests beyond your brand. Just balance it out a little bit and it wouldn’t be so grating. Advertising your own brand doesn’t give anything back. It will damage your company though.
- huhtenberg 2y ago
  > This is fairly common. It'd be nice of you to back up this statement with facts beyond having a "horrible experience with Stripe" and using it to pitch your own project.
werzydev 2y ago
unfortunately feels like Stripe being Stripe. we learned that the hard way too
Traubenfuchs 2y ago
Uh Oh, you hit the front page. Let's count to 5 until we get: "Hi, this is xxx (CEO/CTO of Stripe), this should not have happened. Drop me a mail at xxxx@xxx.xxx and I will have a look at this. (-: " Can we get a CEO in here? A CTO at least? Come on Stripers, I know you are reading this.
- yamumsaho9292 2y ago
  is it still edwin, im out of the loop now lol
- lachyg 2y ago
  I'll bite. I _worked_ at Stripe. Stripe has no authority in decision making here, the issuing bank decides (eg the customers bank) who wins and losses chargebacks. Stripe is a conduit of information, not a party to the decision.
gosub100 2y ago
They're "disrupting" payment processing.
bean-weevil 2y ago
Invalidate the tickets without notifying the customer. That way they travel and everything only to be turned away at the venue.
- thepuppet33r 2y ago
  Yeah, it feels like value wasn't actually lost here unless the ticketing system can't cancel tickets for the event after the fact, or the customer invalidated the charge after the event. If you can invalidate the tickets, then it's effectively as if they didn't purchase them, right?
  - someotherperson 2y ago
    It could be that the tickets were sold as -- or reached a state where -- they were non-refundable. This workflow becomes a hack for refunding things that are non-refundable.
  - tzs 2y ago
    There is a chargeback fee. Google suggests that it is $15 at Stripe.
- sdwr 2y ago
  Reading between the lines, sounds like the seller is reselling the tickets, so it's more of a graymarket transaction, practically, legally and morally.
- recroad 2y ago
  They filed the dispute after the show and after showing their ID at the door which matched then name on the tickets. I can't submit that proof to Stripe as the show is in a different country would literally involve me asking for security cam footage, which is beyond a small business's bandwidth.
  - tpmoney 2y ago
    Someone capable and willing to buy name checked tickets with stolen credit information is probably capable of getting a sufficiently passable fake id for the rushed ticket counter staffer at the concert, and that assumes they even matched the names. I just attended a concert with supposedly name attached tickets that were just scanned at the door with no check against the names/id.
WillPostForFood 2y ago
This is between the bank and the merchant, Stripe doesn't get to make the decision they are the intermediary. Blog title should have been: I Lost $210 in a Bank of America Dispute Despite Proof. They should sue the customer in small claims if it is fraudulent dispute.
- tpmoney 2y ago
  I agree, BoA seems like the people they should be reaching out to to discuss what they need to be collecting to prevent this in the future, and also to answer what IP addresses they compared if it wasn’t sent in the proof. Maybe they already did but as presented this sounds like a dispute with BoA
- BizarroLand 2y ago
  Small claims lawsuit is the right response instead of just being upset over BOA/Stripe. That person defrauded you, sue them. If you evidence is what you say it is, you will most likely win. End of story.
jjmarr 2y ago
So, the customer did a chargeback with their bank, won, and you want Stripe to eat the loss? If I pay for something with a credit card and win a dispute with my bank, should Visa do its own investigation? And if Visa's investigation is different than my bank, do they comp the merchant? Banks already do dispute resolution. It's maybe not the most objective system since the bank is getting paid by the customer, but it's the system we have. I'm not sure why Stripe should have this responsibility as well and I don't see how switching to a payment method other than cash or crypto would've prevented the customer from winning.
Aeolun 2y ago
There was a time when Stripe was an actually nice company to use as a merchant. But it’s just grown into Authorize.net…
grayhatter 2y ago
This evidence seems unconvincing. Why should I believe that it wasn't fraudulent? It's interesting that the bank sent a form letter, but why didn't you include the IP address? Who owns the IP? Is it a residential IP in the geographic area of the venue, or maybe the card holder? Or some cloud provider?
deleted 2y ago
[deleted]
Shank 2y ago
> they resorted to finger-pointing Ahhhh! Stripe is a payment gateway. They’re an intermediary / frontend that simplifies away the complexity of negotiating with each bank and getting your own contract with each bank and integrating with each one separately. I’m sorry to say this, but chargeback fraud is fraud, and you as a business have to deal with that. This customer might have millions in debt with BoA that they’re dutifully servicing. But someone has to eat the cost, and the reality is that this time, it’s you. Either you can take the customer to court or you can ban them from future payments. Alternatively, you can try a payment method that isn’t as easy to dispute, but you’re still exposed to fraud at some level.
shubhamjain 2y ago
> they resorted to finger-pointing. This is not finger-pointing. This is literally how disputes work. Stripe has no role to play in this and they have clarified this in their docs: > Throughout this process, Stripe facilitates your case, but doesn’t have influence over the outcome, which is at the sole discretion of the account owner’s bank. ----- > This is a lie because I never even sent them the IP address since that isn't shown in the evidence I submitted. What if they already have a record of IP address of who did the transaction and they are saying that it doesn't match the geolocation of the customer?
- xnorswap 2y ago
  Indeed, OP hasn't actually stopped to consider, what if BoA is right? What if it really was a fraudulent transaction as claimed? The merchant should consider what they can do to protect themselves in such cases, if they are not protected, such as being able to cancel the tickets.
  - recroad 2y ago
    The guy showed up at the door and watched the show, and only after filed the claim. His name matched the ID at the door. Unfortunately, I don't have access to a video of him showing ID at the door as it's in a different city.
thekiptxt 2y ago
> The decision on who wins a dispute comes down to a judgment call by the bank in which Stripe unfortunately has no role or way of influencing. We are aware of how this resolution can impact you and your business, but as much as we wish we could do more in this scenario, this is the final outcome. What about this could Stripe have done better? Eat the cost of any disputes or fraudulent charges that the bank judges not to be fraud?
jkaplowitz 2y ago
I routinely use different per-company email addresses with most companies I deal with, mainly so that my email is automatically sorted and so that I can deal more effectively with cases where a spammer gets my email address from a company or an marketing unsubscribe request is ignored. The mere fact that my bank and the merchant have different email addresses for me should not give me an unfair advantage in disputes with a merchant. The main protection the merchant has from me is the fact that I'm too honest to fraudulently start this kind of dispute, which is not something a merchant should rely on for their customer base at large. Bank of America's policy is inappropriately merchant-hostile here, and so is Stripe's policy of so blindly deferring to the bank. That said, I'm not truly sure what the right fix is. Names are not globally unique or authenticated, and a fraudster with the necessary credit card information could easily have gone to the website and made the ticket purchase just as easily as the genuine client, even in the example of the linked article. And the last time I used my credit card (legitimately) to buy flight tickets for relatives to visit my wife and me, the only email address I specified belonged to one of my visiting relatives, not to my wife or me. It's a hard problem to fairly solve.
- virgilp 2y ago
  Is it? - 3d secure would have made it hard to claim "wasn't me" - banks here cancel cards involved in fraud, and request a police report (not really a very strong deterrent, but at least makes it risky/harder to repeatedly claim fraud, when it isn't)
  - jkaplowitz 2y ago
    You must not be in the US. Many US-issued cards don't have any meaningful form of 3-D Secure, and many of those that do just have an automated set of risk checks, but not the newest versions common in Europe with live customer authentication through app or one-time passcode. I've actually never seen that level of security on any card from the US or Canada, though I won't guarantee that there isn't some card there which offers it. Similarly, in the US and I suspect also in Canada, a police report is not a routine part of how credit card issuers handle fraud. Not even when the customer is the one to report the fraud to the bank, instead of the bank automatically detecting it.
thiscatis 2y ago
Stripe notifies you of an issuer dispute raised through the respective scheme. They have no control except being a messenger back and forth between you and then customers issuing bank and the scheme. So not on Stripe this one. And this is coming from someone who absolutely despises Stripe. Especially you, Alan from Stripe.
rtcode_io 2y ago
Zarar means loss in Turkish/Persian by the way.
cryptonector 2y ago
It seems the problem here is the bank, not Stripe.
ergocoder 2y ago
I actually appreciate that banks are on the consumer side. In a developing country, the bank would accuse the customers of fraud on behalf of the merchants.

56 points by recroad 2y ago

lancecotingkeh 2y ago

[flagged]

mtmail 2y ago
The last 10 comments were all boilerplate promotion of getopenpay "Please don't use HN primarily for promotion. It's ok to post your own stuff part of the time, but the primary use of the site should be for curiosity." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- lancecotingkeh 2y ago
  Ah sorry! Thanks for flagging
  - hluska 2y ago
    You’ve been doing it for months - so long in fact that I’ve added your company to a list of companies that I won’t go near. I’m not even that devoted to this site but recognize both your name and the repetitive ways you promote your project. Remember that when you try to craft a marketing message, you have to make sure that you’re not doing damage to your brand. You have done a significant amount of damage to your brand because you don’t care about this community.
    - lancecotingkeh 2y ago
      Sorry- I just noticed this post and thought I'd comment. The HN community helped me when I got kicked off of Stripe that I thought it would be a way to give back
      - hluska 2y ago
        Come on bud, I just went through your account and you have only made one comment that didn’t link to your brand. I’m sure you have other things to contribute as I’m sure you have other interests beyond your brand. Just balance it out a little bit and it wouldn’t be so grating. Advertising your own brand doesn’t give anything back. It will damage your company though.
huhtenberg 2y ago
> This is fairly common. It'd be nice of you to back up this statement with facts beyond having a "horrible experience with Stripe" and using it to pitch your own project.

werzydev 2y ago

unfortunately feels like Stripe being Stripe. we learned that the hard way too

Traubenfuchs 2y ago

Uh Oh, you hit the front page. Let's count to 5 until we get: "Hi, this is xxx (CEO/CTO of Stripe), this should not have happened. Drop me a mail at xxxx@xxx.xxx and I will have a look at this. (-: " Can we get a CEO in here? A CTO at least? Come on Stripers, I know you are reading this.

yamumsaho9292 2y ago
is it still edwin, im out of the loop now lol
lachyg 2y ago
I'll bite. I _worked_ at Stripe. Stripe has no authority in decision making here, the issuing bank decides (eg the customers bank) who wins and losses chargebacks. Stripe is a conduit of information, not a party to the decision.

gosub100 2y ago

They're "disrupting" payment processing.

bean-weevil 2y ago

Invalidate the tickets without notifying the customer. That way they travel and everything only to be turned away at the venue.

thepuppet33r 2y ago
Yeah, it feels like value wasn't actually lost here unless the ticketing system can't cancel tickets for the event after the fact, or the customer invalidated the charge after the event. If you can invalidate the tickets, then it's effectively as if they didn't purchase them, right?
- someotherperson 2y ago
  It could be that the tickets were sold as -- or reached a state where -- they were non-refundable. This workflow becomes a hack for refunding things that are non-refundable.
- tzs 2y ago
  There is a chargeback fee. Google suggests that it is $15 at Stripe.
sdwr 2y ago
Reading between the lines, sounds like the seller is reselling the tickets, so it's more of a graymarket transaction, practically, legally and morally.
recroad 2y ago
They filed the dispute after the show and after showing their ID at the door which matched then name on the tickets. I can't submit that proof to Stripe as the show is in a different country would literally involve me asking for security cam footage, which is beyond a small business's bandwidth.
- tpmoney 2y ago
  Someone capable and willing to buy name checked tickets with stolen credit information is probably capable of getting a sufficiently passable fake id for the rushed ticket counter staffer at the concert, and that assumes they even matched the names. I just attended a concert with supposedly name attached tickets that were just scanned at the door with no check against the names/id.

WillPostForFood 2y ago

This is between the bank and the merchant, Stripe doesn't get to make the decision they are the intermediary. Blog title should have been: I Lost $210 in a Bank of America Dispute Despite Proof. They should sue the customer in small claims if it is fraudulent dispute.

tpmoney 2y ago
I agree, BoA seems like the people they should be reaching out to to discuss what they need to be collecting to prevent this in the future, and also to answer what IP addresses they compared if it wasn’t sent in the proof. Maybe they already did but as presented this sounds like a dispute with BoA
BizarroLand 2y ago
Small claims lawsuit is the right response instead of just being upset over BOA/Stripe. That person defrauded you, sue them. If you evidence is what you say it is, you will most likely win. End of story.

jjmarr 2y ago

So, the customer did a chargeback with their bank, won, and you want Stripe to eat the loss? If I pay for something with a credit card and win a dispute with my bank, should Visa do its own investigation? And if Visa's investigation is different than my bank, do they comp the merchant? Banks already do dispute resolution. It's maybe not the most objective system since the bank is getting paid by the customer, but it's the system we have. I'm not sure why Stripe should have this responsibility as well and I don't see how switching to a payment method other than cash or crypto would've prevented the customer from winning.

Aeolun 2y ago

There was a time when Stripe was an actually nice company to use as a merchant. But it’s just grown into Authorize.net…

grayhatter 2y ago

This evidence seems unconvincing. Why should I believe that it wasn't fraudulent? It's interesting that the bank sent a form letter, but why didn't you include the IP address? Who owns the IP? Is it a residential IP in the geographic area of the venue, or maybe the card holder? Or some cloud provider?

deleted 2y ago

[deleted]

Shank 2y ago

> they resorted to finger-pointing Ahhhh! Stripe is a payment gateway. They’re an intermediary / frontend that simplifies away the complexity of negotiating with each bank and getting your own contract with each bank and integrating with each one separately. I’m sorry to say this, but chargeback fraud is fraud, and you as a business have to deal with that. This customer might have millions in debt with BoA that they’re dutifully servicing. But someone has to eat the cost, and the reality is that this time, it’s you. Either you can take the customer to court or you can ban them from future payments. Alternatively, you can try a payment method that isn’t as easy to dispute, but you’re still exposed to fraud at some level.

shubhamjain 2y ago

> they resorted to finger-pointing. This is not finger-pointing. This is literally how disputes work. Stripe has no role to play in this and they have clarified this in their docs: > Throughout this process, Stripe facilitates your case, but doesn’t have influence over the outcome, which is at the sole discretion of the account owner’s bank. ----- > This is a lie because I never even sent them the IP address since that isn't shown in the evidence I submitted. What if they already have a record of IP address of who did the transaction and they are saying that it doesn't match the geolocation of the customer?

xnorswap 2y ago
Indeed, OP hasn't actually stopped to consider, what if BoA is right? What if it really was a fraudulent transaction as claimed? The merchant should consider what they can do to protect themselves in such cases, if they are not protected, such as being able to cancel the tickets.
- recroad 2y ago
  The guy showed up at the door and watched the show, and only after filed the claim. His name matched the ID at the door. Unfortunately, I don't have access to a video of him showing ID at the door as it's in a different city.

thekiptxt 2y ago

> The decision on who wins a dispute comes down to a judgment call by the bank in which Stripe unfortunately has no role or way of influencing. We are aware of how this resolution can impact you and your business, but as much as we wish we could do more in this scenario, this is the final outcome. What about this could Stripe have done better? Eat the cost of any disputes or fraudulent charges that the bank judges not to be fraud?

jkaplowitz 2y ago

I routinely use different per-company email addresses with most companies I deal with, mainly so that my email is automatically sorted and so that I can deal more effectively with cases where a spammer gets my email address from a company or an marketing unsubscribe request is ignored. The mere fact that my bank and the merchant have different email addresses for me should not give me an unfair advantage in disputes with a merchant. The main protection the merchant has from me is the fact that I'm too honest to fraudulently start this kind of dispute, which is not something a merchant should rely on for their customer base at large. Bank of America's policy is inappropriately merchant-hostile here, and so is Stripe's policy of so blindly deferring to the bank. That said, I'm not truly sure what the right fix is. Names are not globally unique or authenticated, and a fraudster with the necessary credit card information could easily have gone to the website and made the ticket purchase just as easily as the genuine client, even in the example of the linked article. And the last time I used my credit card (legitimately) to buy flight tickets for relatives to visit my wife and me, the only email address I specified belonged to one of my visiting relatives, not to my wife or me. It's a hard problem to fairly solve.

virgilp 2y ago
Is it? - 3d secure would have made it hard to claim "wasn't me" - banks here cancel cards involved in fraud, and request a police report (not really a very strong deterrent, but at least makes it risky/harder to repeatedly claim fraud, when it isn't)
- jkaplowitz 2y ago
  You must not be in the US. Many US-issued cards don't have any meaningful form of 3-D Secure, and many of those that do just have an automated set of risk checks, but not the newest versions common in Europe with live customer authentication through app or one-time passcode. I've actually never seen that level of security on any card from the US or Canada, though I won't guarantee that there isn't some card there which offers it. Similarly, in the US and I suspect also in Canada, a police report is not a routine part of how credit card issuers handle fraud. Not even when the customer is the one to report the fraud to the bank, instead of the bank automatically detecting it.

thiscatis 2y ago

Stripe notifies you of an issuer dispute raised through the respective scheme. They have no control except being a messenger back and forth between you and then customers issuing bank and the scheme. So not on Stripe this one. And this is coming from someone who absolutely despises Stripe. Especially you, Alan from Stripe.

rtcode_io 2y ago

Zarar means loss in Turkish/Persian by the way.

cryptonector 2y ago

It seems the problem here is the bank, not Stripe.

ergocoder 2y ago

I actually appreciate that banks are on the consumer side. In a developing country, the bank would accuse the customers of fraud on behalf of the merchants.