Hacker News new | ask | show | jobs
by sbierwagen 16 days ago
Stripe obviously records data around friendly fraud, (At minimum they implement Visa Compelling Evidence 3.0 https://support.stripe.com/questions/how-does-stripe-support... ) and since you did not include screenshots of the messages sent by Stripe support I suspect they were saying something carefully noncommittal and legally compliant to get you to go away, which then got spun into an outraged blog post.
5 comments

> I suspect they were saying something carefully noncommittal and legally compliant to get you to go away

If their total dismissal of the problem is itself deception, that's not a particularly big improvement!

The problem is that, as patio11 once described in detail (https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...), there are genuine tradeoffs here that people get outraged by the mention of. How many legitimate sales should Stripe block in order to more effectively fight this kind of fraud? Merchants don't want to hear it, and consumers don't either. So financial companies invariably conclude that it's better to raise the question only in careful, indirect ways which could not be misinterpreted as a statement that fraud is good or OK or acceptable.
That's a reasonable argument for general money processing, but it's far weaker when you sell an anti-fraud product and try to get every transaction to give you a cut to use it.

And if they had even a little skin in the game they would care about such low-hanging fruit. You don't want a guy that's insulated from the consequences to be in charge of the [anti-]fraud dial.

That link says the customer's undisputed transactions 4 - 12 months ago with you may establish their disputed transaction was actually legitimate, but the article is about someone who only made disputed purchases within a week or two.
> Stripe obviously records data around friendly fraud

My only nit with Stipe is they don't allow me to delete card details for an ongoing subscription I don't plan to renew and already set it not to renew on the service billing page.

What's your point? Do you think it matters what stripe said? What is something that they could've said that wouldn't have justified the outraged blog post?
The author thinks it matters what Stripe said, since they chose to use it as the title for their blog post. To the extent that it was just meant to be a lament that it's hard to be a small online merchant in an era of strong consumer protections, sure, I sympathize. But they seem to think it's a problem with Stripe that could be fixed if Stripe behaved better.
Author here. What makes you think Stripe cannot do better here?
Stripe has a customer's bank saying "the customer says they didn't make this payment" and you saying "the customer told me they did make this purchase and got the item and they're making fun of me".

They have no way to know if your evidence is real, any more than the bank has a way to know if their customer's evidence is real. Either one (or both) of you could be full of shit.

In that world, what would you like Stripe to do better?

What do they feed into their Radar machine learning system? surely there are lots of signals to use here. I'm not saying take only my word and ban this customer forever.

But they have my record as a merchant (successful charges, chargebacks, disputes etc), they have the payer record as a consumer (payments, chargebacks etc), when a merchant submits a dispute, they provide evidence. I provided evidence from DHL that the product was delivered.

No single piece of data is enough on its own, but Stripe is in a perfect position to use all those pieces to be able to better detect fraud.

Yet they explicitly do not use this data at all.

According to payment networks, that chargeback was entirely legitimate

That's why it doesn't get fed into any fraud prevention system. Legitimate chargebacks shouldn't be used to prevent transactions.

You are mad that what you claim to be a flagrantly fraudulent chargeback was approved. Who approved that chargeback, because that's where your actual anger should lie. Ban that bank/provider or whatever and move on with your life.

There's no fraud prevention in this. Payment networks purposely side with the customer here, it's a large part of their business. People use credit cards in part because of the safety and security they provide. They aren't going to suddenly abandon that system because you got scammed out of $30. They won't even do it for companies that get scammed out of millions of dollars a year. Ask me how I know.

If you don't like this system, you are free to stop accepting credit cards, and lose all that business. Most merchants are happy to lose money here and there to facilitate their business.

You insist that stripe's antifraud system should be treating this as fraud, but the process that decides what is fraud or not has decided it is not fraud. This should not be automated in any way. No system tries to automate this "problem customer prevention" because it's a million times harder of a problem than just fraud prevention, likely to ban just as many good customers as bad (because of the probabilistic nature of fraud prevention), and not even remotely worth it. Plenty of companies don't even try to fight it, because then at least you save the $20 chargeback fee.

If you have a problem customer who is more trouble than they are worth, YOU ban them. This customer might have never scammed any other merchant, and those merchants don't want to lose good business because you are nettled over getting scammed.

Based on the quote you provided, the CSR was very specific that what they don't use is merchant-provided evidence. They didn't say they don't leverage information about chargebacks or other disputes.
Happy to share their responses verbatim. It was a rather long back-n-forth. Here's a snippet from the latest email, which I think makes it clear that they do not use the evidence I provided:

    I can assure you that I will take note of your feedback and pass it to our team. Your point about post-transaction abuse detection is valid - while Stripe has robust network-level fraud detection, there does appear to be a gap in utilizing merchant-provided evidence of confirmed fraud to protect the broader merchant ecosystem. This type of feedback from merchants who have direct evidence is valuable for improving these systems.
Theres no gotchas in the quoted text, but curious if you got the impression from your emails that any of it was.. AI generated?

The camber, affirmation, word choice, triplet phrase... leaves me wondering. But without a smoking gun its hard to know if a model call was fired.

Yes most of the communication felt rather LLM assisted or generated. Though to be fair Stripe from my experience always had emphatic support and well written responses. In a way they probably set the gold standard that AI support now mimics.