Live data from Hacker News

Stripe banned us for payment disputes but we never had a single dispute

justuseapp.com

271–280 of 302 posts

Re: Stripe banned us for payment disputes but we never had a single dispute

#271

Earlier quoted context omitted.

Hey, the blog post says we incorporated in the U.S from abroad. We did that with FirstBase.io. Concerning the cards, we do KYC before the cards are issued and we submit same to Stripe. In extreme cases, we ask for users Govt-issued IDs. Our service might be anonymous to the outside facing world but our users are not anonymous to us and Stripe.

Earlier, your website apparently had the statement: > Our credit card comes with a U.S. billing address, so you can unlock features restricted to the U.S or Western markets especially if you don't live there. Allowing customers to easily "spoof" their billing address could be very problematic for me as a merchant. There are countries that I don't want to serve customers in, and in some cases am even prevented (by law…

This is no different than using any virtual PO Box as a billing address.

There is a (very) large number of people who do this, especially in Canada, because US credit cards offer vastly better rewards even after taking foreign transaction fees into consideration.

Re: Stripe banned us for payment disputes but we never had a single dispute

#272

Earlier quoted context omitted.

This is not possible. You cannot fund your account with more than $30 per day unless you are have the highest verification and right now, the limit at those levels is just $60. It will take you years to move $100k at $60 per day.

It's entirely possible for an attacker with 100 stolen identities to make 100 $30/day accounts and move $3,000/day. or $6,000/day if they've stolen the person's government ID. It'll take just over 2 weeks to move $100k at that rate.

They could do this with literally any prepaid card, though.

Re: Stripe banned us for payment disputes but we never had a single dispute

#273

Earlier quoted context omitted.

> We actually have an ongoing project to reduce the occurrence of these mistaken rejections by 90% by the end of this year. I think we’ll succeed at it. (They’re already down 50% since earlier this year.) More important than that is provide a way for people to get this revolved without having to make the front page of HN.

One particularly frustrating aspect of fraud prevention is that fraudsters are better than the rest of us at getting human support staff to do what they want. They have way more practice, and they learn techniques that work from other fraudsters.

> One particularly frustrating aspect of fraud prevention is that fraudsters are better than the rest of us at getting human support staff to do what they want. They have way more practice, and they learn techniques that work from other fraudsters.

Then put a flag on that account. Repetitive issues will make it clear what's happening.

Fraudster also doesn't have the same needs as most customers, they don't need to keep the same account... at best the same account will barely give them more credibility, but that would no longer be true if a flag has been raised previously.

There's plenty of ways to verify identities, use that when a flag has been raised previously. Again, something that sure a fraudster can do but lower odds than an actual customers.

Re: Stripe banned us for payment disputes but we never had a single dispute

#275
post #92
post #84

Earlier quoted context omitted.

Like another commenter said, think about your payment processor like another thing which needs redundancy. Have another one prepared - braintree or whatever.

That's my initial assumption. I'm curious if this is common behavior to have two integrations, or if it is prohibited by the TOS.

You're the customer, but you're a business customer, not a consumer customer. B2C vs B2B is different, and the contracts involved are different, and it's different way of thinking. The Internet I have at my house prohibits reselling because I'm buying it as a consumer. If I'm buying a business Comcast account, there's an expectation by Comcast that I'm going to be reselling the Internet access (like if I own a coffee shop or something). Thus, imo it's not common, but it's also not prohibited. (But I am not a lawyer and this is not legal advice.)

As for having two integrations, what's your opportunity cost? You'll want a backup integration, but imo that's in the same category as having a backup cloud to run on in case AWS goes down. Which, you do, but the time spent working on that is time spent not working on the product.

Re: Stripe banned us for payment disputes but we never had a single dispute

#276
post #108

(Stripe cofounder.) Ugh, apologies. Something very clearly went wrong here and we’re already investigating. Zooming out, a few broader comments: * Unlike most services, Stripe can easily lose very large amounts of money on individual accounts, and thousands of people try to do so every day. We are de facto running a big bug bounty/incentive program for evading our fraudulent user detection systems. * Errors like thes…

  if (transactionInvalid > 5) {
     if (accountPossiblyFraudulent) {
       sendAccountCancellationEmail(accountid))
       stripeBackEnd.closeUserAccount()
     }
  }
It's disgraceful that there isn't multiple layers of careful analysis and INCLUDING personal reachout before canceling an account.

Big companies like Stripe need to be reigned in with legislation because they wield the power to destroy businesses and they do it without care.

Where is Stripes ombudsman - a customer advocate - an independent person with CEO level power within Stripe who's primary duty is to customers and is a channel of last resort when your normal support channels have failed? Why don't you have this?

How can you allow Hacker News to be the channel of last resort?

You're running a financial services company and doing it as though it's unimportant to cancel someones ability to invoice.

The lack of protection for your customers is why companies like Stripe need much tougher regulation.

In fact, you as the co-founder of Stripe should NOT be answering here on Hacker News. You should make it a point to NOT personally resolve such issues because if you have to, then you are acknowledging serious failure in your companies systems and serious letdown of your customers. In fact you should be appalled that Stripe so fails it's customers that they must go to social media to solve valid problems. You should simply be able to rely on some lower level person in Stripe finding this and posting a short message saying "please contact our ombudsman", and being assured that your ombudsman will give it due and fair consideration.

So surely this is not the only time Stripe has mistakenly cancelled an account - but this is the one case where the person who's account was cancelled was able to get their issue on the front page of Hacker News. Therefore is can be said that many people have their accounts mistakenly cancelled by Stripe and have no recourse - again where is your ombudsman?

This is serious systemic failure of Stripe. And the worst thing is it is not just Stripe - this is what people have now come to expect from giant companies that are a critical part of business - such as Apple's app store - people now expect that the company might one day send a random email saying, in effect that your business is over. You can't or won't fix it, so the law should.

Stripe founder need to hear this: "sorry" ain't enough.

Re: Stripe banned us for payment disputes but we never had a single dispute

#277
post #108

(Stripe cofounder.) Ugh, apologies. Something very clearly went wrong here and we’re already investigating. Zooming out, a few broader comments: * Unlike most services, Stripe can easily lose very large amounts of money on individual accounts, and thousands of people try to do so every day. We are de facto running a big bug bounty/incentive program for evading our fraudulent user detection systems. * Errors like thes…

Reading this, it seems like part of the problem was the false message. If there aren't any unauthorized charges, the system shouldn't be sending people rejections falsely claiming that there are. Mistaken rejections are unavoidable, but they can still accurately describe the reason for the rejection.

Re: Stripe banned us for payment disputes but we never had a single dispute

#278

This reminds me of the false-positive vs false-negative dilemma faced in medical testing. Either you optimize for low cost and convenience, or for catching true-positives or true-negatives. For HIV testing for instance, if someone does test HIV-positive falsely, their changed safer behavior in the short-term wouldn't harm anyone, and follow-up tests could catch that they're actually negative. But if we falsely say so…

> What's the right solution? It's case by case, down to a mixture of morality and expertise to decide.

I think the idea of minimizing harm is a really good one.

I've never done any machine learning type stuff, but, based on my limited understanding, I think there are probably a few issues at play that make things difficult.

I think the feedback loop for an algorithm is likely important. If you're training an algorithm to match fingerprints, you have a few things that work in your favor. First, matching is easier with fewer samples, so you can train the model incrementally with larger and larger data sets. Second, the process of identifying false positives is easy, relatively definitive, and isn't influenced by external factors. If the ML algorithm only has X% confidence you send it to a human who assesses the match and tells the algorithm the answer so it can "learn" for the next situation that's similar.

Contrast that with something like payment processing. First, you need to scale with demand and it's not easy to incrementally train the algorithm. Second, false positives don't have a tight feedback loop. A false positive negatively affects a customer and every case is different. You need to rely on external, subjective data that isn't definitive enough to be useful to an algorithm (IMO).

I think matching fingerprints is a good analogy to illustrate some of the problems, especially when you hear things along the lines of "looked too similar to fraudulent activity." With fingerprints, you could give 10 to an amateur and they could probably match them accurately. Scale that up to 10,000 and you have so many that look similar, but not identical and you need a professional to do the matching.

I think ML is similar. It's better on a small scale than it is on a large scale and just doesn't scale up as well as the sales pitch says (unless it's assessing problems with definitive solutions). The issue here is that tech companies are treating ML like it scales in a linear fashion. Just throw more compute at it and 10x the scale, right? Wrong (IMO).

There was another comment here that said something along the lines of getting to 98% accuracy and deciding not to serve the other 2%. I think that's what's happening everywhere, but rather than explicitly telling customers they're not welcome, companies are simply letting their ML algorithms run to find the equilibrium where they can manage the "not positive" rate.

And that goes back to your idea of minimizing harm. They don't want to. They don't care if they promise you service even though you're borderline in terms of triggering false positives. You're part of the data set for their machine learning algorithm and that means you're viewed as acceptable collateral damage. They'll ruin your life to train their ML algorithm(s).

Re: Stripe banned us for payment disputes but we never had a single dispute

#279

I had the same thing happen to our church. I do not believe this is an "Accident". You can read the blow by blow at https://www.jbschirtzinger.com/post/stripe/ You can see very clearly that I also thought this was an automated issue, but turned out not to be.

> What I can tell you, unequivocally, as that these are the End of Days and whatever it is you are here doing it is more consistent with a discriminatory policy of something like the Anti-Christ than anything actually just. This might be the craziest thing I've ever seen in a support email.

If you have a more rational explanation for all the craziness happening, I'm all ears, pal.

Re: Stripe banned us for payment disputes but we never had a single dispute

#280
post #192

Earlier quoted context omitted.

My speculative guess is they raised the bar on the low-pass filter by tightening up the algorithm after losing way too much to credit card fraud. It was absolutely scary the amounts of fraud I dealt with running a dropshipping shop a decade ago. Every bad fraud order that I dropshipped ate the entire profits from a dozen legit orders, and card fraud was attempted on approximately 25% of orders we received. After a fe…

I’m just not sure what to think about practices surrounding these chargebacks any more. When I was working at a company where they were a thing, I don’t think we ever lost one. Does the whole thing just depend on who you are friends with? Or does anyone actually look at the proof you send?

The banks in your country sound much more reasonable and fair.

I'm in Australia and our 4 banks are way too powerful, and some of the worlds most profitable on a percentage basis, with nearly the highest paid executives globally.

In the decade since I deleted that site in despair, there have been several royal commissions / public inquiries into the shocking unfair and outright illegal actions all the 4 banks systematically entrenched, including forging customer signatures, ripping off customers at every opportunity, including siphoning customers money when the bank knew they had died, facilitating money laundering of cash earned from drugs on vast scales, influencing our captured politicians to roll back recently-legislated consumer protection laws the previous govt enacted, to absolve them from any culpability whatsoever by writing larger "liar loans" they knew people would struggle to live with, and these are which still going strongly (approx 1 in 3 recently admitting to this in a follow-up survey).

The AUD$35 per chargeback was an easy profit centre for them a decade ago, and no way would they ever take my side when it was free money for them.

I had a USD bank with them for the ecommerce dropship account. Our average order was around USD$51 with a little over 10% gross profit.

I was the only one losing out. The bank, my dropship supplier, and the card fraudsters all got paid and received their goods.

Post reply on HN