[lachyg]

(I work on Stripe Issuing.)

We've been primarily focused to date on companies where issuing cards is core to providing their business to customers, for example a startup that provides expensing customers, or a platform that needs to purchase goods in the real world. We're less focused on a business just using it for their own expensing (as we don't have receipt upload functionality, etc).

To your two other questions though:

(1) Could users approve things in real time? Sort of. We provide the ability (as you noticed) through API, but it needs to be responded to in < 2s, which means it's not possible for a human to be in the flow.

(2) Could this be linked to an external bank account? Again, sort of. To get in the weeds: as soon as we approve an authorization, we're on the hook for those funds. A debit to an external balance (or bank account) may fail and Stripe would be on the line. This is why we typically require funds to be in a Stripe account prior to purchases taking place.

[ryandrake]

As a credit card customer it would be nice to be able to generate one or more temporary cards (physical or not), which are authorized for one transaction only, but are otherwise identical to my main card. That way I can use it with a merchant I simply don’t trust to have their act together, then safely toss it in the trash.

[subsubsub]

As a previous commenter mentioned Revolut do this.

However I would suggest a temporary card that only lasts for 2 transactions.

- the authorization charge (e.g. $1 on amazon.com) [1]

- the actual amount of the purchase

Too many times I have been caught out by the authorization charge, only to have the actual purchase fail.

[1] https://aws.amazon.com/premiumsupport/knowledge-center/aws-a...

[homero]

I use privacy.com which is awesome

[dvfjsdhgfv]

To save others a click - looks good, but US-only.

[jv22222]

Just signed up and had a poke around, created a few cards. I have to agree it looks excellent.

[ForHackernews]

Citibank already offers this feature on their credit cards, I believe: https://www.cardbenefits.citi.com/Products/Virtual-Account-N...

[abawany]

I used to use this pretty thoroughly but a few issues have caused me to stop altogether now:

* Flash app means that in newer versions of Android (edit: 6+ IME), even with an old Adobe Flash for Android apk loaded and with Firefox, the functionality no longer works in mobile (input functionality is broken.)

* Cards used for time-limited recurring expenses (subscriptions that I intend to end in 1 year, for example) would arbitrarily fail transactions resulting in hassle. Since each number was locked to the processor who requested the first transaction, I suppose one reason this happened was if a business switched processors mid-stream.

I have always wondered why no one has created a nice mobile solution for this very useful feature. It seems that credit cards want each customer to just use one number and trust that their risk department will stop data leaks - seems like a bad solution.

[akeating]

I've been watching Revolut who introduced something like this a while back https://blog.revolut.com/introducing-disposable-virtual-card...

[gant]

I used that for a while, until a billing network banned me for using too many cards with my name.

[f00_]

i'm thinking about using privacy.com, what ended up happening? What is a billing network?

[gant]

They're sort of an intelligence network for payment processors. Took a few days and it worked again, but just be aware that having a new credit card every payment might put you in a higher risk bucket.

[xeromal]

I've been using products that facilitated this for the past 10 years and one has yet to stick.

Paypal had a firefox extension that did this about 10 years ago.

https://getfinal.com/ was fantastic and I used it for about 2 years. I was one of the first 700 applicants. It worked exactly as you described and you could even set dollar limits for monthly recurring charges. They folded earlier this year and I was sad to see my CC cancelled. :(

[fragmede]

GetFinal was acquired by Goldman Sachs which may or may not fit your definition for "folded".

[julianozen]

Check out privacy https://privacy.com/

[felix_nagaand]

Probably to shelve the idea.

[toomuchtodo]

Proven teams from unprofitable ventures are frequently acquired to work on other business ventures with higher likelihood of success.

[nixgeek]

Privacy.com is doing this today although it’s a debit card (AFAIK).

[JamesBarney]

Just wanted to say I've used them and they're great. You can set limits on the virtual card. As well as have them lock to only one vendor. So as soon as the sale goes through no other vendors can charge the card.

[bound008]

Check out Capital One. They have the ability to have multiple virtual cards that you can turn on or off.

https://www.capitalone.com/applications/eno/virtualnumbers/

[germainelol]

As others have said, try out Revolut. I believe it's only part of the premium package which sucks, but they offer throwaway cards for this purpose.

[mehrdadn]

Have you looked into the existing options? Citi and Bank of America for example support virtual card numbers (virtual account numbers and ShopSafe, respectively).

[ceejayoz]

Capital One does, as well. Unfortunately, it requires a browser extension, which I'm not a big fan of.

[mehrdadn]

Ah, yes, the UI (Flash-based in the cases I mentioned!) is definitely clunky, so it's not surprising Capital One's is similar. They also tend to hide the feature a little bit for some reason; it's not prominently displayed. But otherwise it's there and nevertheless usable if you can find it. If you need it on literally a daily basis, though, it might not be smooth enough to be comfortable.

[toomuchtodo]

Could you MITM the extension to reverse engineer the API calls it makes and write a command line tool to perform the required functions?

I have a friend at CapOne, I’ll ask tomorrow.

[aussieguy1234]

What would be good, would be to have a card number generated that expires 10 minutes later, that you could use as a "one time code" to purchase stuff

[miketery]

Been waiting for something like this for a while. Much nicer if you can keep a ledger of these auth'd cards and revoke if need be.

[kbuck]

A few banks provide a system like this. I'm aware of at least Bank of America and Citi.

Bank of America calls it "ShopSafe"; you can generate a number for one-time or recurring payment with an associated limit and expiration date.

Citi calls it Virtual Account Numbers. Theirs don't have a limit by default (but you can create one that does).

Unfortunately, both systems use archaic Flash applets to generate and manage the numbers... I hate the Citi one in particular because it has sound effects when you press buttons.

[Animats]

Yes, ShopSafe is useful when dealing with flaky businesses.

[VectorLock]

I've wanted something like this for a long time as well. The ability to generate and discard one-off card numbers. Much less worry about those card numbers leaking, unauthorized transactions, etc.

[arama471]

Privacy.com does this

link: https://privacy.com

[cyrux004]

I have been in US for 10 years and have had this since the first time in I opened an account in BOFA. The feature is called ShopSafe

[bradknowles]

Check out privacy.com for that.

[aussieguy1234]

Startup idea of the week

[tezza]

entropay.com has similar virtual cards for a ~4% fee

[voltagex_]

Entropay.com is great - I use it for sites that really don't want my Australian dollars (normally this is enough for me to never buy from them, but sometimes I really do need the product). The cards are "American", but appear to be issued somewhere in the EU - I've had the number rejected by someone, maybe Sling?

I do wonder if I'm getting flagged as a higher fraud risk when I use it, though.

[anirudhmurali]

True, I remember my card at Entropay being registered under Malta, Europe. But fortunately, online services accepted it.

[voltagex_]

Do you remember how you checked this? I wonder if there's a BIN lookup somewhere.

[ryanworl]

Regarding 2), can Stripe Connect be used with Issuing? If each user of a Connect app just had their own Stripe account with their own balance, that sounds a lot simpler (for the developer).

[lachyg]

Yes!

[Immortalin]

So we can build an e-wallet service with Stripe Connect? If so, I would love to get in touch to discuss more!

[ryanmarsh]

or a platform that needs to purchase goods in the real world

So like Shipt or Postmates?

[sdmike1]

Do you think this API could be used to create non-card payment tokens? For instance an implanted Java card like the VivoKey[0]?

[0]https://vivokey.com/learn-more.html

[foota]

That's amazing. I could imagine a personal web app where you set some sort of a personal spending limit and have to pre-approve transactions over that limit.

[semerda]

Quick Q, who plays the role of the bank holding the backing funds? Or does stripe simply play the role of a transmitter,

Btw is this similar to Marqeta‘s JIT solution?

[lachyg]

We play the role!

[curryhowardiso]

To confirm, you meaning Stripe?

Does this work in all banking jurisdictions?

[atlasunshrugged]

He means Stripe (he introduced himself earlier in the thread), don't know the answer to the second q

[thedougie]

lachyg - who is the sponsoring bank for the visa and / or mastercard BIN's you issue?

[homero]

How do you fund a stripe account without taking payments as a merchant at stripe

[tbgvi]

Hopefully increasing the response time to > 2s (whether it's settable in the API or just has a longer timeout) is on the roadmap, I can think of lots of future use cases where you would want a human in the loop on authorizations.

Looks like a great product and props to you and your team for shipping this.

[driverdan]

That's not possible. Transactions need to be approved at the POS within a reasonable amount of time. Waiting for a human is to respond is not reasonable.

You could pre-approve the transaction and then confirm it within 2 sec though.

[tbgvi]

Pre-approving a transaction would do the trick and it wouldn't hold up the line, good call.

[LeifCarrotson]

I can also imagine of lots of future, intensely frustrating use cases where a user scans their card in a line at a point-of-sale, or is waiting on a "Confirming purchase, please wait" page on a website while your human in the loop puts this approval on hold for a few minutes until your cell phone finally rings.

Currently, human-in-the-loop approvals do happen, but they happen long after the purchase goes through - ever gotten a call from your bank's card services department as you were leaving a gas station on a road trip? Much more convenient for the common use case where the human approves the transaction than the rare cases when the bank is on the hook for the stolen gas.

[umurkontaci]

There's actually an implementation of this for online sales in Europe (and probably other places in the world), it's called 3D Secure: https://www.visa.ca/en_CA/visa-everywhere/security/future-of...

It adds a step during checkout where you are redirected to your bank/card issuers page to answer some security questions.

[Semaphor]

Yeah, I need to open my banking app and approve the payment there. I think it needs to be supported by the vendor though

[nickda]

Since this is an API, that means you just build this into your app. You could initially decline the transaction, send a push alert to the user's app notifying them that the transaction is in review, then update them on that status when approved/declined. At that point the card can be run again and approved if that was the decision. You could even allow a pre-request through the app, when when approved would enable your user's card for the purchase. The possibilities are endless.