My suggestion is to just ban specific regions or countries and you can cut 80% of this fraud.<p>I'm not going to name those countries outright but you should never ever be launching globally until you have these safeguards in place.<p>Once you are known to be vulnerable to a certain scheme, it quickly becomes known in that region/country.<p>Again and again I'm reminded why high trust societies remain high trust and why low trust societies rarely transform into high trust society.
I've got 13 chargebacks over the last 4 years for my biz. Out of these, 10 came from US based cards. The other 3 came from Australia(my country).<p>Be careful when taking verbatim advice from internet strangers.
I live in Kazakhstan (I assume that's one country nobody heard of and would disable in their dashboard) and my bank doesn't even have any UI for chargebacks, nor I ever heard about anyone doing chargebacks. They even explicitly warn me sometimes that I assume all responsibility for that payment. I guess I can go through some process, it's VISA after all, but it's definitely not something I can do easily.
+1 almost all from the US.<p>The strongest signal is whether they use an eBank/app that has a one-click button to report transactions as fraudulent. The Apple card(?) seems especially prevalent.
I had a friend with the apple card, and there were fraudulent charges on her card before she even used it.<p>I think that caused her to over-scrutinize things.<p>But (years) later I saw her using apple pay. She had charges she didn't recognize and would immediately flag them. Thing is, I couldn't help but think they might have been real charges with weirdly named companies on the transaction.
not to mention, thats pretty bad advice for these chargeback frauds. not gonna deny some regions have higher risk of frauds, but these are mostly high-volume automated schemes.<p>in the case of these "friendly fraud" schemes, they are much more likely to come from more developed regions with strong consumer protection laws like the NA.<p>if anything in many of those "high risk" regions, chargeback are much less common because fewer consumer protection law e.g. banks would automatically reject chargebacks for transactions with 3DS OTP.
13 over 4 years is tiny sample compared to what I've seen on international scale.<p>Great advice which is why data is what I'm relying on vs anecdotes.
Yeah, all my chargebacks are Americans. Realtors are the worst.
How big is your business and where does it sell?<p>One chargeback a quarter is a lot, depending.
Just because the card is US-based doesn't mean the user is.
This case was Canada.<p>The US and I imagine Canada are known for the ease of chargebacks.<p>My experience in Europe is that it's a very tough process to even initiate (as a consumer)
Why do you not want to name them?
Accept crypto for those countries, it doesn't have chargebacks and helps those vulnerable to the financial system.
I went down a bit of a search looking for counter evidence that crypto is likely less available to them, and it turns out both perspectives are true depending on the scale you look at. At the micro-level, survey data from emerging markets[0] confirms that crypto offers immunity against institutional failure and inflationary currency.<p>But this QJE article[1] argues there's a ceiling to how far things scale. Concluding that the cost to keep a decentralized network secure scales with its total economic value. So while there is immediate value to it's user, it might not scale well, and can't replace a country's financial system anyway because securing it at a sovereign scale would just be more expensive.<p>[0]: <a href="https://www.mdpi.com/1911-8074/17/10/467" rel="nofollow">https://www.mdpi.com/1911-8074/17/10/467</a>
[1]: <a href="https://academic.oup.com/qje/article/140/1/1/7824430" rel="nofollow">https://academic.oup.com/qje/article/140/1/1/7824430</a>
I dont follow. If regular finance to a country is that much distanced from global financial oversight and treaties where crypto (with awful spreads) becomes the norm that doesnt necessarily mean they are victims of international financial order but that regular financially modeling simply cannot manage their unique risk characteristics
Damn, I made a great reply and it never sent–that sucks.<p>I was more nuanced and specific, but I don't want to do it all again.<p>1. The fees are not awful idk what you mean, I pay between 0.1% and 1% fees on Monero transactions.<p>2. If the modelling can't manage their risk characteristics, they are by definition a victim of the financial system. I was more talking about people who have been debanked, though.<p>I have a Russian friend who can't pay for things online in fiat because of sanctions and the risk to his life from being on the free internet. So, he uses Monero and Tor and takes his OPSEC seriously. He is a victim of trad-fi, and Monero allows him to take his freedom back.
This is actually one of the major reasons people should be very weary of accepting crypto, especially Monero. Instead of being able to basically outsource sanctions compliance to a bank, you take on the burden of trying to figure out if your customers are sanctioned yourself - with potentially dire consequences to your business if you get it wrong.
Have you ever actually used crypto to buy something? The transaction fees are exorbitant and prohibitive, and it's slow as balls.
Yes, all the time. I usually pay a 1 cent fee and the transaction goes through in seconds. Not sure what you're talking about.<p>I can send you some if you want to try it out, just drop an address(for a wallet I recommend cakewallet, but any popular open source wallet works).<p>I'm talking about Monero specifically, but your reply makes no sense because there are cryptos that have 0 transaction fee and instant confirmaiton. But they are less secure and private so I don't use them, I only use Monero.
That depends on the currency you use. I've only ever used Monero and the transfer fees are fractions of a cent.
Man people are still using the "it's a currency" grift when discussing crypto, did the El Salvador failure really teach you nothing?<p><a href="https://en.wikipedia.org/wiki/Bitcoin_in_El_Salvador" rel="nofollow">https://en.wikipedia.org/wiki/Bitcoin_in_El_Salvador</a>
That's less because it was Bitcoin and more because the entire effort was a slapdash affair pushed by Bukele in an effort for him and his buddies to profit off the cryptocurrency boom rather than being an inherent knock on cryptocurrency itself.<p>Also of all the cryptocurrencies Bitcoin is a pretty poor choice since it could be pretty well argued that it has lost the original purpose and devolved into a raw "line go up" financial instrument.
That's the whole thing with Monero. It's actually used as a currency, not as a get rich quick scam. I believe 99% of crypto is a scam, but Monero is a real improvement for payments. The Monero community actually wants it to be adopted to spend it, it's not a price go up community.<p>Buy food with Monero on an ebay type platform called xmrbazaar.<p>(<a href="https://xmrbazaar.com/search-category/food/" rel="nofollow">https://xmrbazaar.com/search-category/food/</a>)<p>Donate to non-profits in Monero<p>(<a href="https://donatemonero.org" rel="nofollow">https://donatemonero.org</a>)<p>GrapheneOS says it's the only crypto that they regularly get recurring small donations in.
Crypto does have the distinct cash like advantage of not having chargebacks. I don’t know of any other digital payment system with that property.
> I'm not going to name those countries outright<p>Why?
>"Again and again I'm reminded why high trust societies remain high trust and why low trust societies rarely transform into high trust society."<p>Outside of South Korea, from enormous help from Pax Americana, has it ever happened?
Agreed. If we could cut off all the non first world countries from our internet, I would be so relieved on so many levels and on so many issues. Sadly technically not feasible and too late, the damage to our societies is already done.
[flagged]
[flagged]
I run a saas and we get this every now and then.<p>As a rule of thumb, when you get a chargeback you need to completely ban the customer from your db.
This includes:<p>- card ban
- email address ban
- fingerprint their access and ban<p>This will save you a lot of hassle when they try to signup/buy your product again and cause you the same amount of grief.
Exploiters easily get around this. its a small group of people doing all of the abuse.
All 3 of those identifiers can be easily changed by advanced users. I'm curious what you mean by fingerprint their access. Is this like an on demand fingerprinting, I've only seen browser fingerprinting as a tracker for every user.
Use DeviceCheck if iOS app too. Uber does this to ban across accounts
You'd better be promptly responsive to legitimate customer support inquiries if you are going to have a policy like that
> They told me they don’t use evidence of chargeback abuse from one merchant to create cross-merchant fraud signals, or to take action against the customer’s card, email, or other details for other merchants.<p>I'm surprised they were able to get Stripe to actually state all of this clearly. It's nice that Stripe actually communicates details like this. But you can see the logic behind why many other big companies would just respond with an opaque message like "<i>thank you for your report, it will be handled in the appropriate manner</i>". Because saying the truth gets people more upset.
No, vagueness gets me much more upset, but there's just nothing to write about in those cases.
>No, vagueness gets me much more upset, but there's just nothing to write about in those cases.<p>I think this hits on the spirit behind GP's point. Clarity, leading to an article like the one posted, gets more people upset. The equation (Upset/People x People) results in a larger number -- people, as a whole, are more upset.<p>>But you can see the logic behind why many other big companies would just respond with an opaque message like "thank you for your report, it will be handled in the appropriate manner". Because saying the truth gets people more upset.<p>If a company is vague, there's nothing to write about, one person (maybe) gets more upset than they would have facing clarity.<p>But if the company is clear, there is something to write about, and an article like the one posted makes people, overall, more upset.
No. I would have been far more upset about a vague response. I was still upset that they don't do anything about it.<p>(it took a bit of back-n-forth to get a clear answer, but I did get a clear one. Their support is still excellent from my experience and communicate well)
The customer screwed you over, and then their bank did too. Stripe didn't. I'm not sure why Stripe is getting blamed in the title and the article.<p>Yeah, maybe Stripe could do more without Radar, but I imagine it could also be fraught if Stripe was in the business of blocking customers from their entire network based on one vendor's complaint. Obviously a lot could go wrong with such an approach.
Yes. But Stripe didn't do anything to prevent the next merchant from falling into the same trap. They had all the evidence, and ignored it.<p>That was the point I tried to make with my blog post. And yes, if it was too easy for merchants to block consumers, that won't be fair either. But surely there's a middle ground here.<p>Stripe very explicitly told me that they don't do anything with such reports. It's simply ignored.
> it could also be fraught if Stripe was in the business of blocking customers from their entire network based on one vendor's complaint<p>“You probably don’t want a system where one annoyed merchant can get someone blocked across the whole Stripe payment system. But there’s a pretty big gap between “automatically block this person everywhere” and “thanks for the screenshots, please consider Radar”, and this is where it gets frustrating.”
I dealt with millions of dollars in chargebacks with Stripe. We sold tickets, they're easy to re-sell and our customers were tourists visiting shows from all over the world.<p>Stripe Radar was not a good product. It would score large numbers of very suspect transactions at a risk level of 1 or 2 (out of 100). I don't have an ML background, but something about their methodology was just flawed. It behaved as if there was a wire loose in it. Unfortunately, I don't think they're very incentivized to care.
Solid post. The key takeaway for me was Stripe admitting they won't use post-dispute evidence of friendly fraud to build cross-merchant signals in Radar. That, plus the customer literally bragging about it after winning the chargeback, shows how lopsided the system is against indie sellers. Thanks for sharing.
This is just fraud.<p>"Friendly fraud" is accidental or with the correct intentions – such as the customer not recognising the charge and charging back.
This is the point. You could file criminal charges. You could win in civil court.
Yes, and Stripe could do much better to prevent it. And doesn't.
At this point I’m fairly convinced Stripe is Paypal 2.0, at least in spirit:<p>* Turns a blind eye to misdeeds on its platform<p>* Locks out adult creators/vendors after taking their money<p>* Is ubiquitous, but not well liked<p>I love that Stripe changed the game of fintech and made it accessible to more parties in a programmatic way, but I find myself repeating “avoid Stripe” to a lot of folks asking me for advice on dealing with payment nowadays for those reasons.
That’s just the nature of these industries.<p>1) Incumbent is slow, clunky, unpleasant to deal with due to years of accumulated constraints to deal with<p>2) Newcomer can differentiate themselves by being nimble and pleasant to work with, taking market share<p>3) Over time newcomer has to deal with increasing amount of scrutiny, fraud, overhead, CYA type practices, etc<p>4) Newcomer is now incumbent, goto 1)
Who do you recommend as an alternative?
Nowpayments is good for an easy crypto payment gateway.<p><i>No affiliation</i>, I've just seen them used–it would be better if you self-hosted a BTCPay server.
I don’t have one at the moment, at least for my circles (artisans, craftspeople, adult creators in general). Much of it has fallen back on PayPal for folks without an LLC to hide behind, or Square if they’re incorporated as a business. The trick has been discretion and operating in a gray area: “novelty goods”, “graphic design work”, and “outerwear” as item descriptors or db entries, obscuring the actual content without actually lying or deceiving the payment processor.<p>Most paypros, most of the time, won’t look too hard unless there’s a problem or you’re tripping some internal security measure (like raking in a lot of cash in weird amounts). Of late they’ve been more intrusive due to some weird eTeen puritans, but that’s quieting down again as they remember they like making money, and throwing legal content off their platforms can very quickly cause an exodus of customers looking to avoid having their funds seized.
I got hit with a fraudulent chargeback (claim was the purchase was unauthorized and the person showed up in person to a class) and it was doubly bad because they paid via Link which means that Stripe actively verified them via 2FA.<p>Can someone explain to me why Stripe (or a competitor) doesn't offer a setting "refuse transactions for cards that have filed > x chargebacks with <acquirer> merchants this year"?
Yeah, though this rule sounds a bit tricky. Like what if someone legitimately had their card abused.<p>The thing that gets me is that Stripe boasts about their machine learning radar rules etc etc, but somehow can't feed it actually valuable data.<p>Stripe support saw the emails from the customer boasting about defrauding me, they completely agreed that this is a clear case of friendly-fraud, but did nothing with this info.
<i>claim was the purchase was unauthorized and the person showed up in person to a class</i><p>Certainly <i>a</i> person showed up in person to a class, but how do you know it was the person whose credit card was used?
Their business model is to allow as many possible "valid" transactions, not to serve their "clients". They're a PSP...
I don't <i>know</i> this is the reason, but if I were asked to build such a system, I'd be pretty worried that it constitutes a consumer report under the terms of the Fair Credit Reporting Act.<p>Certainly I wouldn't want the inevitable news drama about it. "I'm just a poor innocent grandma, I'm a trusting person when it comes to Facebook ads, and Stripe punished me for getting scammed by banning me from half the stores on the Internet!"
I help a lot of client with their ecommerce websites (mostly WooCommerce), attacks became so common recently, could be AI, but I found the best way to deal with this is to trace the patterns in access log and block the same patterns of checkout submission, this have worked really well for me. There are a lot of card testing attacks that Stripe doesn't care to handle as well as a lot of other fraud techniques, but there is always a pattern, especially automated ones. There is country, IP range, certain behavior (eg; no js, or direct api calls..etc). I really think it's easy to deal with this if you're willing to look deeper than a dashboard.
Stripe obviously records data around friendly fraud, (At minimum they implement Visa Compelling Evidence 3.0 <a href="https://support.stripe.com/questions/how-does-stripe-support-visa-compelling-evidence-3-0" rel="nofollow">https://support.stripe.com/questions/how-does-stripe-support...</a> ) and since you did not include screenshots of the messages sent by Stripe support I suspect they were saying something carefully noncommittal and legally compliant to get you to go away, which then got spun into an outraged blog post.
Happy to share their responses verbatim. It was a rather long back-n-forth. Here's a snippet from the latest email, which I think makes it clear that they do not use the evidence I provided:<p><pre><code> I can assure you that I will take note of your feedback and pass it to our team. Your point about post-transaction abuse detection is valid - while Stripe has robust network-level fraud detection, there does appear to be a gap in utilizing merchant-provided evidence of confirmed fraud to protect the broader merchant ecosystem. This type of feedback from merchants who have direct evidence is valuable for improving these systems.</code></pre>
> I suspect they were saying something carefully noncommittal and legally compliant to get you to go away<p>If their total dismissal of the problem is <i>itself</i> deception, that's not a particularly big improvement!
The problem is that, as patio11 once described in detail (<a href="https://www.bitsaboutmoney.com/archive/optimal-amount-of-fraud/" rel="nofollow">https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...</a>), there are genuine tradeoffs here that people get outraged by the mention of. How many legitimate sales should Stripe block in order to more effectively fight this kind of fraud? Merchants don't want to hear it, and consumers don't either. So financial companies invariably conclude that it's better to raise the question only in careful, indirect ways which could not be misinterpreted as a statement that fraud is good or OK or acceptable.
> Stripe obviously records data around friendly fraud<p>My only nit with Stipe is they don't allow me to delete card details for an ongoing subscription I don't plan to renew and already set it not to renew on the service billing page.
That link says the customer's undisputed transactions 4 - 12 months ago with you may establish their disputed transaction was actually legitimate, but the article is about someone who <i>only</i> made disputed purchases within a week or two.
What's your point? Do you think it matters what stripe said? What is something that they could've said that wouldn't have justified the outraged blog post?
The author thinks it matters what Stripe said, since they chose to use it as the title for their blog post. To the extent that it was just meant to be a lament that it's hard to be a small online merchant in an era of strong consumer protections, sure, I sympathize. But they seem to think it's a problem with Stripe that could be fixed if Stripe behaved better.
I assume that this is basically just not worth pursuing for small-scale orders (e.g. $15ish for Ciglue), but for larger ones what are the reasonable approaches for scenarios that don't involve stolen card fraud?<p>Notably disputing a credit card charge is completely independent of whether someone owes the debt, the credit card is simply a convenient way for that payment to be handled. What's the point where other collection methods make sense? As an example, if you're consulting for someone and they pay you $x,xxx via card then charge it back, at least in most of the US I believe it's legal for you to do your own collection efforts and contact them repeatedly (this changes if you sell the debt and it's a third party attempting collections).
Correct, the debt is still valid.<p>You can try to collect through persistence, or take them to court, get a judgment, and then a court ordered collection. It all depends on the value of your time.<p>I’ve heard rumors that some merchant agreements with processors may include arbitration clauses for recovering chargebacks, but I’ve never seen it personally.
So I can crack open a Backwoods, stick my weed in there, and then glue back together with Ciglue? That's pretty cool.
I am pretty convinced that friendly fraud is about 90% of chargebacks. I have seen some genuine fraud, but dwarfed by friendly fraud over time across 3 companies.
There aren't any screenshots of conversations with Stripe support in the blog post, but I'm guessing one other reason is that support agents are incentivised to close tickets or end conversations as quickly as possible.
A friend of mine has a "1 dispute and your banned rule"... sounds like it could help in this situation. He'll catch wind of someone disputing they didn't receive a product he makes, despite his OCD with packaging, and gets a chargeback. He sits down each week with all the chargebacks he's gotten and bans them from future sales. It's not often but when he does, he complains about it when I see him.
I had a customer do something similar with a thousand-dollar product. They had signed for delivery and provided no evidence, but banks always side with the customer.
To be fair, from stripe's point of view, how would they know that you and the alleged customer are not in on it for some reason they don't know?
"Friendly fraud" is when the cardholder <i>is</i> in on it. They or an accomplice they've given access to their credit card go to a merchant, order and receive an expensive item with the card and then file a chargeback claiming they didn't make the purchase so they can keep both the item and the money.
What would be there to gain? The merchant loses money to the credit card processing fees, chargeback fees, and shipping cost along with the loss of the product, they gain nothing. Its a pretty expensive way to send a customer a free thing.
? in on what?
Use EMV 3DS 2.x authentication with liability shift protection?
You know enough about the buyer to sue them or report them to the FBI.
A lawsuit will cost you at least thousands of dollars if you can even serve the person. The FBI doesn't care about even thousands of dollars of fraud; they are busy chasing million dollar crime rings. Try reporting to your local police and see what they say - they will advise you it is not even worth your time to write out a report because it won't be investigated. Heck, my mom was defrauded out of $10k by a persistent group of people running a fake crypto investing company, and when she reported to the government body specifically responsible for investigating those cases, the nice man said, "Thanks for letting us know." They don't have time to investigate and prosecute minor fraud.
Suing someone in the Philippines probably won’t be worth the effort for an $18 product. And the FBI probably will not care much about a $18 international fraud.
I lose disputes all the time, no matter the evidence. I'm not happy with Stripe. The only thing keeping me from looking at alternatives is the low volume of fraud committed against my SaaS.<p>Do better Stripe. Be better Stripe. Or eventually we will find someone better. Think. Don't enshittify. Your support has already become covered in it by doing the needful.
Isn't this a property (and longstanding value judgement) of the entire payment card ecosystem?
When a problem is industry-wide, people are naturally going to complain about the most prominent companies, but that's not necessarily even wrong. The most prominent companies are the ones in the strongest position to actually do something about it (e.g. develop better detection for friendly fraud or lobby for sensible regulatory changes), and have a stronger incentive to when they're the ones who keep getting blamed.
<a href="https://www.bitsaboutmoney.com/archive/optimal-amount-of-fraud/" rel="nofollow">https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...</a> Classic patio11 article.
Then what are the better alternatives?
Nothing, it’s a 5% bobcat problem. The card processors can force the merchants to eat it and there’s nothing you can do save not accepting cards, which loses you the other 95% of the market.<p><a href="https://xkcd.com/325/" rel="nofollow">https://xkcd.com/325/</a>
Monero or honestly any crypto. There's no chargebacks and it can be more private.
That's fine for some things but my grandma is not going to buy from an online store that only takes crypto. Crypto as a payment option works well for computer-related merchants or for privacy-focused merchants. Like it wouldn't be uncommon to rent a VPS with crypto but it would be strange for an online candy store to accept it.
> That's fine for some things but my grandma is not going to buy from an online store that only takes crypto.<p>Of course not, unless it becomes mainstream, crypto usage will always be by early adopters and technologists. I don't care if you accept cards as well, I just want to be able to pay privately with Monero.<p>You're right that for chargebacks specifically the only way to eliminate them would be 100% crypto, not the option of card and crypto together, which is significantly more likely. But there are other benefits for customers(privacy), which is why I use it.
Don't most crypto exchanges ban Monero?
>And the bank, naturally, sided with them.<p>How is it natural if DHL had proof of delivery.
Signifyd (company) solves this issue.
[flagged]