5 ms·

It's true that Stripe have almost non-existent anti-fraud tools. We've been using Maxmind's minFraud and have been building a bunch of filters and logic on top

It's true that Stripe have almost non-existent anti-fraud tools. We've been using Maxmind's minFraud and have been building a bunch of filters and logic on top of it. We shouldn't need to do this but as a marketplace we were being hit by OBVIOUS fraud that we need to do something since Stripe wouldn't step up their game, at some point the fraud amounted to ~20k in a very narrow window of time and Stripe didn't stop these transactions as fraud even though it was so obvious (US Card, IP from Thailand and 20 charges within a few minutes), this is when we decided we had to do something about it. We've even blogged about it here: http://www.binpress.com/blog/2012/07/31/fighting-online-fraud-pitfalls-and-solutions/ http://www.binpress.com/blog/2012/07/31/fighting-online-frau... Regarding chargebacks - I usually don't bother to fight them anymore, since we're a marketplace selling digital assets - we are most likely to lose. However the exception is when I'm 100% that charge is legitimate and was disputed by its owner. Since we offer an unconditional 14 days money back guarantee and make it really easy to request a refund (sometime even outside of that 14 days window), whoever illegitimately dispute a charge is sure to get a fight from us. A few months ago we disputed 2 "fraudulent" chargebacks from a customer we knew was behind these charges. We even reached out to him asking him to cancel the chargebacks and offering assistance (maybe he just wanted a refund) but never heard from him. I proceeded to collect all the information I could: IP and location, email thread he exchanged with the developer selling the component requesting support, his apps on the appstore and even his personal information behind hid domain's whois for his email's domain. I didn't expect much knowing that because that was an intangible sale we were not protected, but few weeks later we received an email from Stripe that we won that chargeback (Total was ~$1,000 which we already paid to our developers - so that was a net loss for us). I was pleasantly surprised and regained confidence in Stripe. However from the original post of the author, it seems he was doing services for that person. In case services - I recommend to collect as much information as possible including getting the customer to sign on a contract. With all of that information, I doubt someone could dispute a charge. Credit Card companies will never dispute a charge that actually happened and that you approved even if the service was partly rendered since this is not their role to take sides, they will usually ask you to take this to court. Therefore I think the author could have won that chargeback if he had collected as much information as possible and put a PDF together highlighting the facts.

patio11 13y ago
You can, indeed, lose chargebacks even if you have a signed contract or whatnot in place. It is totally at the discretion of the issuing bank, and generally something decided in 5 minutes by a fairly low-level employee. AR has lost chargebacks where our evidence included a statement by the CEO of the customer saying the charge was accepted and that AR was key to his business. (His bookkeeper didn't know that so she reversed 6 months of charges at once.)
- adambenayoun 13y ago
  You are completely correct that Stripe has no control over this and this is at the sole discretion of the issuing bank. I think I was pointing that the "you can't win intangible good chargeback" is not true anymore and if you can put together a good case with lot of proofs sometime you might win. By the way, no one really talked about this but there's always a possibility to sue the customer if the charge is really big and the customer reside in the same country than you are (for example US). Of course this is up to you to decide if this is worth the effort (Most cases this isn't).
anurag 13y ago
I'm very sorry about these issues, and appreciate the vote of confidence. Looking back at the state of our fraud controls in July 2012, we've definitely come a long way. We're currently testing a revamped set of fraud prevention controls (in private beta) and they have been extremely effective for some of our largest users. Email me at anurag@stripe.com if you're interested!
- adambenayoun 13y ago
  Hey Anurag - this is ok, we stuck with you mainly because you were (and still are) disrupting an industry led by heartless cyborg and you guys were doing something good. I could understand why you didn't have any good prevention tools but I think 2014 should be the year you guys make a step toward accomplishing this. I've emailed you when you made that initial comment on this thread - hopefully we can discuss about anti-fraud and that will result in better tools in your arsenal in the longer term.

patio11 13y ago

You can, indeed, lose chargebacks even if you have a signed contract or whatnot in place. It is totally at the discretion of the issuing bank, and generally something decided in 5 minutes by a fairly low-level employee. AR has lost chargebacks where our evidence included a statement by the CEO of the customer saying the charge was accepted and that AR was key to his business. (His bookkeeper didn't know that so she reversed 6 months of charges at once.)

adambenayoun 13y ago
You are completely correct that Stripe has no control over this and this is at the sole discretion of the issuing bank. I think I was pointing that the "you can't win intangible good chargeback" is not true anymore and if you can put together a good case with lot of proofs sometime you might win. By the way, no one really talked about this but there's always a possibility to sue the customer if the charge is really big and the customer reside in the same country than you are (for example US). Of course this is up to you to decide if this is worth the effort (Most cases this isn't).

anurag 13y ago

I'm very sorry about these issues, and appreciate the vote of confidence. Looking back at the state of our fraud controls in July 2012, we've definitely come a long way. We're currently testing a revamped set of fraud prevention controls (in private beta) and they have been extremely effective for some of our largest users. Email me at anurag@stripe.com if you're interested!

adambenayoun 13y ago
Hey Anurag - this is ok, we stuck with you mainly because you were (and still are) disrupting an industry led by heartless cyborg and you guys were doing something good. I could understand why you didn't have any good prevention tools but I think 2014 should be the year you guys make a step toward accomplishing this. I've emailed you when you made that initial comment on this thread - hopefully we can discuss about anti-fraud and that will result in better tools in your arsenal in the longer term.