Stripe is friendly to “friendly fraud”(gingerlime.com) |
Stripe is friendly to “friendly fraud”(gingerlime.com) |
Anything that actually discourages that behavior directly is better than some slightly more negative reputation in an opaque fraud detection system.
How is it natural if DHL had proof of delivery.
Do better Stripe. Be better Stripe. Or eventually we will find someone better. Think. Don't enshittify. Your support has already become covered in it by doing the needful.
They have a comprehensive customer ID system and let you adjust desired risk levels for various forms of fraud.
Epic username btw lol
Of course not, unless it becomes mainstream, crypto usage will always be by early adopters and technologists. I don't care if you accept cards as well, I just want to be able to pay privately with Monero.
You're right that for chargebacks specifically the only way to eliminate them would be 100% crypto, not the option of card and crypto together, which is significantly more likely. But there are other benefits for customers(privacy), which is why I use it.
The point many people have made here is fair. That this is not just about whether Stripe can reverse a specific dispute after the fact; it’s about whether clear evidence of chargeback abuse can help protect the next business. We can do more there.
There is a real balance to strike overall that we are working towards. We do not want a world where a report from one business automatically blocks a buyer across all businesses on Stripe. Legitimate disputes happen, consumer accounts get compromised, and false positives from over-blocking can hurt real buyers.
But there is a gap between “automatically ban this person everywhere” and “thanks for the screenshots” and we want to build solutions here.
We've seen friendly fraud grow significantly, and it's pushed us to evolve Radar from transaction fraud protection into a broader product that protects a business from fraud and abuse across various points in the customer lifecycle, like account signup, trial start, etc. There's a ton more we can do but here's a few things we're working on to help:
- Tracking serial chargeback abusers. We're working on identifying serial abusers of the dispute process across Stripe's network, and surfacing that to businesses before the transaction happens, as well as leverage it in our decisioning.
- Scoring the risk holistically. While we'll keep building fraud and abuse solutions that help at individual points of the customer lifecycle (trial, payment, refund, etc), we're starting to score customer accounts themselves for aggregate abuse risk, leveraging Stripe network data. We're actively working on product-izing this now.
- Helping you win disputes when friendly fraud happens. Friendly fraud can be really hard to capture. We want to prevent as much as possible, but we also want to make it as easy as possible to fight back against friendly fraud when it does happen. Our Smart Disputes product already incorporates friendly fraud insights into the evidence we compile, and we’re seeing early success. We're building more defenses as well as working to enrich merchant-submitted evidence.
Many of our best ideas come directly from our users. If anyone wants to share feedback on Radar, feel free to email me at jacobmeltzer at stripe dot com.
That said, I don't think you're really addressing the main point on my post. There is clear evidence here of intentional fraud, yet Stripe does nothing with it.
And from what I gathered previously with my own experience, and supported by comments on this discussion, Stripe win rate for disputing chargebacks is virtually nil. I'd love to be proven wrong here if you can share your actual win/lose rate stats.
As a rule of thumb, when you get a chargeback you need to completely ban the customer from your db. This includes:
- card ban - email address ban - fingerprint their access and ban
This will save you a lot of hassle when they try to signup/buy your product again and cause you the same amount of grief.
I'm surprised they were able to get Stripe to actually state all of this clearly. It's nice that Stripe actually communicates details like this. But you can see the logic behind why many other big companies would just respond with an opaque message like "thank you for your report, it will be handled in the appropriate manner". Because saying the truth gets people more upset.
(it took a bit of back-n-forth to get a clear answer, but I did get a clear one. Their support is still excellent from my experience and communicate well)
I think this hits on the spirit behind GP's point. Clarity, leading to an article like the one posted, gets more people upset. The equation (Upset/People x People) results in a larger number -- people, as a whole, are more upset.
>But you can see the logic behind why many other big companies would just respond with an opaque message like "thank you for your report, it will be handled in the appropriate manner". Because saying the truth gets people more upset.
If a company is vague, there's nothing to write about, one person (maybe) gets more upset than they would have facing clarity.
But if the company is clear, there is something to write about, and an article like the one posted makes people, overall, more upset.
Stripe Radar was not a good product. It would score large numbers of very suspect transactions at a risk level of 1 or 2 (out of 100). I don't have an ML background, but something about their methodology was just flawed. It behaved as if there was a wire loose in it. Unfortunately, I don't think they're very incentivized to care.
Yeah, maybe Stripe could do more without Radar, but I imagine it could also be fraught if Stripe was in the business of blocking customers from their entire network based on one vendor's complaint. Obviously a lot could go wrong with such an approach.
That was the point I tried to make with my blog post. And yes, if it was too easy for merchants to block consumers, that won't be fair either. But surely there's a middle ground here.
Stripe very explicitly told me that they don't do anything with such reports. It's simply ignored.
Also I just wanna throw some praise at Stripe Support. They have an excellent team and go above and beyond to help.
I have worked in card issuing for years and I have seen various submissions by merchants I know that use Stripe where I _know_ that they have an absolute winning case under the network rules that Stripe refuse to contest.
Stripe have decided that fighting most chargebacks is not worth the money, probably becasue they can just pass the costs onto the merchants and let them eat them and the merchants will not go elsewhere.
* Turns a blind eye to misdeeds on its platform
* Locks out adult creators/vendors after taking their money
* Is ubiquitous, but not well liked
I love that Stripe changed the game of fintech and made it accessible to more parties in a programmatic way, but I find myself repeating “avoid Stripe” to a lot of folks asking me for advice on dealing with payment nowadays for those reasons.
1) Incumbent is slow, clunky, unpleasant to deal with due to years of accumulated constraints to deal with
2) Newcomer can differentiate themselves by being nimble and pleasant to work with, taking market share
3) Over time newcomer has to deal with increasing amount of scrutiny, fraud, overhead, CYA type practices, etc
4) Newcomer is now incumbent, goto 1)
No affiliation, I've just seen them used–it would be better if you self-hosted a BTCPay server.
Most paypros, most of the time, won’t look too hard unless there’s a problem or you’re tripping some internal security measure (like raking in a lot of cash in weird amounts). Of late they’ve been more intrusive due to some weird eTeen puritans, but that’s quieting down again as they remember they like making money, and throwing legal content off their platforms can very quickly cause an exodus of customers looking to avoid having their funds seized.
Can someone explain to me why Stripe (or a competitor) doesn't offer a setting "refuse transactions for cards that have filed > x chargebacks with <acquirer> merchants this year"?
Certainly I wouldn't want the inevitable news drama about it. "I'm just a poor innocent grandma, I'm a trusting person when it comes to Facebook ads, and Stripe punished me for getting scammed by banning me from half the stores on the Internet!"
The thing that gets me is that Stripe boasts about their machine learning radar rules etc etc, but somehow can't feed it actually valuable data.
Stripe support saw the emails from the customer boasting about defrauding me, they completely agreed that this is a clear case of friendly-fraud, but did nothing with this info.
Certainly a person showed up in person to a class, but how do you know it was the person whose credit card was used?
"Friendly fraud" is accidental or with the correct intentions – such as the customer not recognising the charge and charging back.
"Just fraud" is already taken for "criminal c uses unwitting cardholder a's card at unwitting merchant b", so what's your objection against "fiendly fraud"?
Even in the post you're wishy washy about what you want. They offer a product that does enhanced fraud detection but you don't like that. You correctly call out that there's major risks with taking a merchant's report and using it to flag a user's future transactions.
For me, I do a cheap subscription (4$/mon, first month 2$) and one dispute costs me like 20-30$. So that one person wipes a ton of profit from me. I always try to refund them (but you can't refund a customer with a dispute in effect).
Stripe is great to get going, but has a lot of painful points.
I always thought things are easier with a physical product where you have a 3rd party like DHL that proves delivery was made. But at least in my tiny sample space, that’s not enough to win the dispute.
Notably disputing a credit card charge is completely independent of whether someone owes the debt, the credit card is simply a convenient way for that payment to be handled. What's the point where other collection methods make sense? As an example, if you're consulting for someone and they pay you $x,xxx via card then charge it back, at least in most of the US I believe it's legal for you to do your own collection efforts and contact them repeatedly (this changes if you sell the debt and it's a third party attempting collections).
You can try to collect through persistence, or take them to court, get a judgment, and then a court ordered collection. It all depends on the value of your time.
I’ve heard rumors that some merchant agreements with processors may include arbitration clauses for recovering chargebacks, but I’ve never seen it personally.
I suspect Stripe walks a fine line where they want to help you prevent fraud, but they also want to avoid vendors complaining to them that their customers can’t pay.
Context: I worked on a payments team for a short while.
I'm not going to name those countries outright but you should never ever be launching globally until you have these safeguards in place.
Once you are known to be vulnerable to a certain scheme, it quickly becomes known in that region/country.
Again and again I'm reminded why high trust societies remain high trust and why low trust societies rarely transform into high trust society.
Yes, many of us are incredibly responsive to customer support inquiries (I have a <1hr response time unless you send in a ticket when I'm sleeping) and it doesn't matter. Fraudsters gonna fraud. This isn't a case of "they asked for a refund, we refused, they issued a chargeback", it's a case of a scammer being a POS.
I've dealt with my fair share of chargebacks and in every case I've seen it's someone being a jerk and never a legit case.
The fact that Stripe won't help you, the banks don't care about all the evidence you have, and you end up out the money for the product _and_ you get hit with a chargeback fee on top of it is madness. I could literally have video of the person holding up their ID saying "I XXXXX agree to pay YYYY" and banks would still side with a the scummy scammers.
I have, quite literally, never had someone reach out via support and then file a chargeback later. They do it without reaching out, probably because they are a trash person and they have no interest in getting anything fixed and are just scammers.
“You probably don’t want a system where one annoyed merchant can get someone blocked across the whole Stripe payment system. But there’s a pretty big gap between “automatically block this person everywhere” and “thanks for the screenshots, please consider Radar”, and this is where it gets frustrating.”
If their total dismissal of the problem is itself deception, that's not a particularly big improvement!
My only nit with Stipe is they don't allow me to delete card details for an ongoing subscription I don't plan to renew and already set it not to renew on the service billing page.
I can assure you that I will take note of your feedback and pass it to our team. Your point about post-transaction abuse detection is valid - while Stripe has robust network-level fraud detection, there does appear to be a gap in utilizing merchant-provided evidence of confirmed fraud to protect the broader merchant ecosystem. This type of feedback from merchants who have direct evidence is valuable for improving these systems.The camber, affirmation, word choice, triplet phrase... leaves me wondering. But without a smoking gun its hard to know if a model call was fired.
Be careful when taking verbatim advice from internet strangers.
The strongest signal is whether they use an eBank/app that has a one-click button to report transactions as fraudulent. The Apple card(?) seems especially prevalent.
in the case of these "friendly fraud" schemes, they are much more likely to come from more developed regions with strong consumer protection laws like the NA.
if anything in many of those "high risk" regions, chargeback are much less common because fewer consumer protection law e.g. banks would automatically reject chargebacks for transactions with 3DS OTP.
Great advice which is why data is what I'm relying on vs anecdotes.
One chargeback a quarter is a lot, depending.
The US and I imagine Canada are known for the ease of chargebacks.
My experience in Europe is that it's a very tough process to even initiate (as a consumer)
But this QJE article[1] argues there's a ceiling to how far things scale. Concluding that the cost to keep a decentralized network secure scales with its total economic value. So while there is immediate value to it's user, it might not scale well, and can't replace a country's financial system anyway because securing it at a sovereign scale would just be more expensive.
[0]: https://www.mdpi.com/1911-8074/17/10/467 [1]: https://academic.oup.com/qje/article/140/1/1/7824430
Outside of South Korea, from enormous help from Pax Americana, has it ever happened?
Why?
X isn’t bad. You should include Y. You only added/omitted Z because of $stereotype/$racistView/$otherAllegation.
Probably just not worth the hassle.
You can’t ignore the stereotypes, but you can let people figure it out themselves. You don’t have to say it when it’s already obvious.
But Stripe is exactly in a position to at least use the evidence I provided (in this case, the evidence included the customer clearly admitting to friendly fraud), and feed it into their fraud-prevention system in some way. This way, lots of signals can help protect merchants from friendly fraudsters. So yes, I see it as a pretty small and legit ask from Stripe.
If you’re talking about premium cigars, using paper is possible but kinda ugly. The glue is similar to what rollers use when rolling cigars in the factory. It works well and fits well with the cigar smoking experience.
You don’t have to buy (my) glue. You can make your own and I even share recipes on the website. Ciglue however offers convenience with the dispenser and integrated brush and glue.
(wasn’t expecting to get into details about my product on HN but love how diverse the community is)
There are similar offerings from other companies. I don't know if bundling this with payment processing is common.
If it happens to be a slow day, or the person is already on their shit list (eg. on probation) maybe something will come of it. Having the gloating emails definitely helps. Or maybe the report just goes into a file until this person does this for a more expensive item and then it gets pulled to prove a pattern of behavior.
Given that you are responsive to inquiries, it makes sense that you'd rarely if ever have a legitimate chargeback -- because there's no reason for a customer to resort to chargebacks if the vendor is willing to work with them to resolve legitimate issues.
But I know of many examples of people needing to resort to chargebacks due to ineffectual customer support, and then having their accounts banned and being cut off from other unrelated services from the same vendor as a result. I don't think that's an appropriate response and vendors should be careful not to let that happen if they instate such a policy.
And if they had even a little skin in the game they would care about such low-hanging fruit. You don't want a guy that's insulated from the consequences to be in charge of the [anti-]fraud dial.
* You sell legal goods or services and are entirely honest about them to the paypro; if the T&Cs change down the line, your honesty makes you a prime target for having your funds seized and ability to process transactions terminated first, posing an existential threat to your business with no reward for your honesty
* You sell legal goods and services, but don’t volunteer extraneous details about them since that’s not the business of a paypro. Should the T&Cs change, your obscurity buys you time to adapt or seek alternatives before inevitably being caught up in the paypro’s internal surveillance measures.
* You sell legal goods and services, but assume your paypro is hostile from the get go regardless of the T&Cs and hand over the minimal information necessary to process a transaction. You have maximum time to find alternatives should the T&Cs change, because your baseline operations make it that much harder to identify your transactions down the line.
Honesty is inevitably punished while obscurity is rewarded, at least for a time. It’s also worth pointing out the hypocrisy of needling paypro users to follow arbitrary and changing rules of the paypro but allowing said paypros to reject legal transactions for whatever reason they wish or selectively comply with laws because they’re “fintech” and not banks or payment card networks: why should users face more onerous restrictions than the paypro themselves?
Ultimately the solution is the same one we’ve been parroting for years ever since PayPal arbitrarily changed their T&Cs to try booting adult creators off its platform: government regulations barring these entities outright from refusing any legal transaction. It’s part of the playbook at this point for tech companies in light of its success: court adult content creators and communities to grow the platform, then shut them out once there’s money to be made.
I don't think Stripe did the right thing here. They can do better to protect their own customers.
if buyers were to perceive stripe as being dificult, they might churn. i certainly do this on paypal pages.
Is this an edge case? It looks like your standard chargeback fraud accompanied by a pile of evidence. What does a common case look like in contrast?
We should expect this to become even more rampant given the ease of clicking a chargeback button and the apparent lack of repercussions.
It doesn't seem like an unreasonable ask frankly.
They have no way to know if your evidence is real, any more than the bank has a way to know if their customer's evidence is real. Either one (or both) of you could be full of shit.
In that world, what would you like Stripe to do better?
But they have my record as a merchant (successful charges, chargebacks, disputes etc), they have the payer record as a consumer (payments, chargebacks etc), when a merchant submits a dispute, they provide evidence. I provided evidence from DHL that the product was delivered.
No single piece of data is enough on its own, but Stripe is in a perfect position to use all those pieces to be able to better detect fraud.
Yet they explicitly do not use this data at all.
Not very easy to do with prepaid cards AFAIU.
my paypal aversion stems from interacting with the service. ex: charges show in my CC but are not listed on paypal account
The protection against that is the legal system unfortunately.
So nobody really knows about it.
When i started selling digital download content. Some people will buy, download and instantly charge back.
In Western Europe, a chargeback is not that unheard of, but it still requires you to make your case and follow a procedure and review. It's not that lengthy or difficult, but you cant just buy something online and then do a chargeback, unless you can clearly show that the download is not working and tried the helpdesk or you were mislead or something
I suspect most decisions are now made based on ambient factors such as “does this customer file above average chargebacks; if not, believe whatever they entered in our multiple choice questionnaire” or “if we have any undisputed payment on the same card by the same account, push back, otherwise eat the loss”. Part of this is even getting codified by newer network dispute evidence rules as well.
Since nobody ever seems to hold cardholders accountable for misrepresentation, and since it’s psychologically much easier to lie on a whimsical multiple choice form you fill on your bank app when bored on the bathroom than to sign a printed document containing a short summary of the legal consequences of willful deception, the situation is what it is.
Sometimes, whether a society is actually “high trust” depends on the transaction amount, and whether that amount warrants legal expenses on either side.
And let me tell you, nowhere in my circle that I know of have ever raised one single chargeback in these 15 years. Not one.
This seems more of a developed-countries thing to me.
I can send you some if you want to try it out, just drop an address(for a wallet I recommend cakewallet, but any popular open source wallet works).
I'm talking about Monero specifically, but your reply makes no sense because there are cryptos that have 0 transaction fee and instant confirmaiton. But they are less secure and private so I don't use them, I only use Monero.
I too have plenty of purchasing experience with crypto and I wouldn’t advocate for it for any legal transaction.
It's easy to get in the USA on Kraken from fiat for a very low fee or 0 with their pro plan.
> Monero is also far from instant in my experience.
It's up to the merchant to decide how many transactions before finishing their end of the deal. For small purchases it's low risk to do 0 confirmations and you can scale with price.
I've seen hundred dollar sales given out as soon as the transaction hits the mempool, before the first confirmation as well as 5 dollar sales that require waiting the whole 10 confirmations.
I was more nuanced and specific, but I don't want to do it all again.
1. The fees are not awful idk what you mean, I pay between 0.1% and 1% fees on Monero transactions.
2. If the modelling can't manage their risk characteristics, they are by definition a victim of the financial system. I was more talking about people who have been debanked, though.
I have a Russian friend who can't pay for things online in fiat because of sanctions and the risk to his life from being on the free internet. So, he uses Monero and Tor and takes his OPSEC seriously. He is a victim of trad-fi, and Monero allows him to take his freedom back.
Idk where you are getting this, but "risk to his life from being on the free internet" is total BS.
>Gao Yu, a veteran independent journalist and dissident, has been harassed by police repeatedly for visiting and posting on Twitter.
https://www.voanews.com/a/east-asia-pacific_voa-news-china_c...
It's already banned in Russia, it's not crazy to say that you could get in trouble.
Recently they have been cracking down even more. (https://www.bbc.com/news/articles/cr510de17jlo)
Also of all the cryptocurrencies Bitcoin is a pretty poor choice since it could be pretty well argued that it has lost the original purpose and devolved into a raw "line go up" financial instrument.
Buy food with Monero on an ebay type platform called xmrbazaar.
(https://xmrbazaar.com/search-category/food/)
Donate to non-profits in Monero
GrapheneOS says it's the only crypto that they regularly get recurring small donations in.
I think that caused her to over-scrutinize things.
But (years) later I saw her using apple pay. She had charges she didn't recognize and would immediately flag them. Thing is, I couldn't help but think they might have been real charges with weirdly named companies on the transaction.
That's completely the companies fault. If you give a transaction a reference that the customer will not recognise, that's on you!
Whether your bank knows how to use them well to represent your interests is a different matter. For example, I’ve seen banks decline chargebacks against bankrupt merchants in certain countries because they were poorly advised about the legal ramifications, and other banks in the same country win the exact same kind of dispute. Lacking sufficient reading comprehension to parse the dispute rules (it’s a long PDF!) also seems common.
That's why it doesn't get fed into any fraud prevention system. Legitimate chargebacks shouldn't be used to prevent transactions.
You are mad that what you claim to be a flagrantly fraudulent chargeback was approved. Who approved that chargeback, because that's where your actual anger should lie. Ban that bank/provider or whatever and move on with your life.
There's no fraud prevention in this. Payment networks purposely side with the customer here, it's a large part of their business. People use credit cards in part because of the safety and security they provide. They aren't going to suddenly abandon that system because you got scammed out of $30. They won't even do it for companies that get scammed out of millions of dollars a year. Ask me how I know.
If you don't like this system, you are free to stop accepting credit cards, and lose all that business. Most merchants are happy to lose money here and there to facilitate their business.
You insist that stripe's antifraud system should be treating this as fraud, but the process that decides what is fraud or not has decided it is not fraud. This should not be automated in any way. No system tries to automate this "problem customer prevention" because it's a million times harder of a problem than just fraud prevention, likely to ban just as many good customers as bad (because of the probabilistic nature of fraud prevention), and not even remotely worth it. Plenty of companies don't even try to fight it, because then at least you save the $20 chargeback fee.
If you have a problem customer who is more trouble than they are worth, YOU ban them. This customer might have never scammed any other merchant, and those merchants don't want to lose good business because you are nettled over getting scammed.
> Plenty of companies don't even try to fight it, because then at least you save the $20 chargeback fee.
That’s sad in my opinion. It shouldn’t be the norm. Stripe support encouraged me to file a dispute and submit evidence but next time I prob won’t bother.
I personally find it disappointing that Stripe is in a position to do something about it but prefers the status quo that clearly allows such fraud to continue.
Not universally supported unfortunately, but the major stores support it.
The cardholder’s contractual relationship is always with the card issuer, which is usually a bank or some other financial institution. This is no different in the US. If something on your bill seems off, you contact the one that issued it, i.e. your bank.
Viseca seems like it might actually be an issuer directly (it’s also a common model that banks only act as program managers, delegating actual issuance to a different entity) but I’m not familiar with them.
Many banks only show payments (so only after cleared) and not reserved funds. They will just show that you don't have the full credit available
This was introduced to not unnecessarily block debit card funds for days but it works like that for credit cards as well now.