Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe is friendly to “friendly fraud”

gingerlime.com

Post reply on HN
Print view View original

181–190 of 258 posts

Re: Stripe is friendly to “friendly fraud”

#181

Post by modo_mario »

zuzululu wrote: post #28

My suggestion is to just ban specific regions or countries and you can cut 80% of this fraud. I'm not going to name those countries outright but you should never ever be launching globally until you have these safeguards in place. Once you are known to be vulnerable to a certain scheme, it quickly becomes known in that region/country. Again and again I'm reminded why high trust societies remain high trust and why low…

I'm no longer convinced those high trust societies will remain so. Every high trust society has been pushed to opened it's doors wide and the changes have been stark.

Re: Stripe is friendly to “friendly fraud”

#182

Post by lxgr »

dahcryn wrote: post #174
shric wrote: post #169

Earlier quoted context omitted.

In what backward place does this happen? It shows up the second I pay here (Australia)

it's common, they reserve an amount, and then update towards the final payment. These are not payments as such, and almost always take 48 hours to clear. Same at hotel rooms usually etc.. Many banks only show payments (so only after cleared) and not reserved funds. They will just show that you don't have the full credit available

The update with the final amount happens within minutes after you’re done pumping, not only at batch clearing time.

This was introduced to not unnecessarily block debit card funds for days but it works like that for credit cards as well now.

Re: Stripe is friendly to “friendly fraud”

#183

Post by lxgr »

fweimer wrote: post #154
plantain wrote: post #84

Earlier quoted context omitted.

+1 almost all from the US. The strongest signal is whether they use an eBank/app that has a one-click button to report transactions as fraudulent. The Apple card(?) seems especially prevalent.

U.S. chargeback rules are different. In other countries, you cannot repudiate credit card transactions that you authorized (and this applies to Mastercard/Visa, too). You need to do something else if you end up in a dispute with the merchant.

That’s completely false. Visa/Mastercard chargeback rules are fairly uniform globally, and disputes are possible in many (if not all) non-US countries as well.

Whether your bank knows how to use them well to represent your interests is a different matter. For example, I’ve seen banks decline chargebacks against bankrupt merchants in certain countries because they were poorly advised about the legal ramifications, and other banks in the same country win the exact same kind of dispute. Lacking sufficient reading comprehension to parse the dispute rules (it’s a long PDF!) also seems common.

Re: Stripe is friendly to “friendly fraud”

#184

Post by lxgr »

fweimer wrote: post #180
soco wrote: post #175

Earlier quoted context omitted.

You open a ticket where you describe what happened and attach everything you have. It happened to me twice over the years, both with Visa, and I had them both approved. I'm not sure that in the age of AI agents they would care anymore, but I can dream right.

Over here, it's common that consumers don't have a direct relationship with the card company. I'm not sure if they would even be able to identify me.

What do you mean by card company?

The cardholder’s contractual relationship is always with the card issuer, which is usually a bank or some other financial institution. This is no different in the US. If something on your bill seems off, you contact the one that issued it, i.e. your bank.

Re: Stripe is friendly to “friendly fraud”

#185

Post by pseudo0 »

gingerlime wrote: post #94
tonyarkles wrote: post #54

Earlier quoted context omitted.

Suing someone in the Philippines probably won’t be worth the effort for an $18 product. And the FBI probably will not care much about a $18 international fraud.

Yeah. This case Canada. Not sure where to report but seems unlikely to do anything. Will happily report out of principle so any tips welcome.

You presumably have their shipping address, so you can look up their local police department and report it as general fraud. Eg. The Toronto police have an online reporting tool for fraud and scams: https://www.tps.ca/services/online-reporting/

If it happens to be a slow day, or the person is already on their shit list (eg. on probation) maybe something will come of it. Having the gloating emails definitely helps. Or maybe the report just goes into a file until this person does this for a more expensive item and then it gets pulled to prove a pattern of behavior.

Re: Stripe is friendly to “friendly fraud”

#186

Post by amelius »

zuzululu wrote: post #28

My suggestion is to just ban specific regions or countries and you can cut 80% of this fraud. I'm not going to name those countries outright but you should never ever be launching globally until you have these safeguards in place. Once you are known to be vulnerable to a certain scheme, it quickly becomes known in that region/country. Again and again I'm reminded why high trust societies remain high trust and why low…

That's very lazy and unfriendly against people who are not fraudsters.

Re: Stripe is friendly to “friendly fraud”

#187

Post by lxgr »

wahnfrieden wrote: post #15
shash7 wrote: post #10

I run a saas and we get this every now and then. As a rule of thumb, when you get a chargeback you need to completely ban the customer from your db. This includes: - card ban - email address ban - fingerprint their access and ban This will save you a lot of hassle when they try to signup/buy your product again and cause you the same amount of grief.

Use DeviceCheck if iOS app too. Uber does this to ban across accounts

Great, another thing to worry about when buying a used phone: Did any of the previous owners get banned by any of the apps I intend to use on it?

Re: Stripe is friendly to “friendly fraud”

#189

Post by lxgr »

dahcryn wrote: post #172
omnimus wrote: post #167

Earlier quoted context omitted.

Yeah it's not a thing available to customers outside of western countries. Even in eastern europe countries a chargeback means making a lengthy complaint with the bank and if they decide to trust you then they make chargeback. So nobody really knows about it. When i started selling digital download content. Some people will buy, download and instantly charge back.

wait, people can just do that? How does that even work? Does Visa not supposedly protect both the seller and the buyer? In Western Europe, a chargeback is not that unheard of, but it still requires you to make your case and follow a procedure and review. It's not that lengthy or difficult, but you cant just buy something online and then do a chargeback, unless you can clearly show that the download is not working and…

It’s supposed to be the same in the US, but due to heavy automation on both sides, the “evidence” presented on either side is essentially pages of rasterized TIFF slop propping up a handful of bits of ground truth data.

I suspect most decisions are now made based on ambient factors such as “does this customer file above average chargebacks; if not, believe whatever they entered in our multiple choice questionnaire” or “if we have any undisputed payment on the same card by the same account, push back, otherwise eat the loss”. Part of this is even getting codified by newer network dispute evidence rules as well.

Since nobody ever seems to hold cardholders accountable for misrepresentation, and since it’s psychologically much easier to lie on a whimsical multiple choice form you fill on your bank app when bored on the bathroom than to sign a printed document containing a short summary of the legal consequences of willful deception, the situation is what it is.

Sometimes, whether a society is actually “high trust” depends on the transaction amount, and whether that amount warrants legal expenses on either side.

Re: Stripe is friendly to “friendly fraud”

#190

Post by gingerlime »

ro_sharp wrote: post #164

All of these may result in you bringing in less $ overall, so it really depends on how much each fraud case costs you, but you could (off the top of my head): - Enable always checking CVV - Require 3DS - Ban a card after N disputes - Ban an email/other identifier after N disputes - Ban certain payment methods, banks etc - Add a visible or invisible captcha to fight automated abuse/card testing I suspect Stripe walks…

None of the technical measures you mentioned are relevant with “friendly fraud”. And that’s exactly the problem that Stripe doesn’t solve. And doesn’t want to help merchants fight against.
Post reply on HN