Hacker News new | ask | show | jobs
by Brystephor 756 days ago
Genuine question: Is fraud actually something that costs Stripe money when it comes to payouts?

The reason credit card fraud for charges costs money to processors is because of charge backs. I believe charge back fees originate from the card networks themselves (Visa, MasterCard, etc). These processors also enforce a variety of limits when it comes to chargebacks for each merchant. This means if you're the layer between the merchant and the network, the merchants generally will rely on you to pre-emptively detect fraud. Those systems all cost money too.

As far as I know when it comes to payout rails such as ACH, real time payments (RTP), Zelle, I don't believe the payment processor holds any liability for fraudulent transactions. In other words, if a fraudulent payout occurs through stripe via RTP then The Clearing House banks aren't going to come after stripe for the money. They'll tell the end user "whoops, should've taken better care of your digital info. Bye!"

source: Worked at a payment processor and worked on payout rails and integrating with banks. Also do work now as an end user of a different payment processor that does charging, payouts, etc.
1 comments
mike_d 756 days ago
It's not that simple. Charge backs are a game of hot potato originating at the card issuing bank and making its way back to the merchant.

If Stripe instantly pays out funds to a merchant and there is a charge back, they have to claw that money back. This is normally done by drafting the funds from the deposit account, but if that is empty Stripe (or whatever processor) eats it and it becomes a collections issue.

Processors normally handle this by holding funds on suspicious transactions for 180 days (the max chargeback window). What is suspicious? For most processors it is literally whatever adds up to a [fraud rate]% of your volume over a 180 day window. Stripe doesn't do this because they are "the friendly processor" so they just take a bigger slice and cover losses out of that.

source: I spend a non-trivial amount of time monitoring threat actors and figuring out exactly how they are doing bad stuff, which means understanding the risk/abuse side of the house

link