←back to thread

693 points hienyimba | 1 comments | | HN request time: 2.674s | source
Show context
pc ◴[] No.28523805[source]
(Stripe cofounder.)

Ugh, apologies. Something very clearly went wrong here and we’re already investigating.

Zooming out, a few broader comments:

* Unlike most services, Stripe can easily lose very large amounts of money on individual accounts, and thousands of people try to do so every day. We are de facto running a big bug bounty/incentive program for evading our fraudulent user detection systems.

* Errors like these happen, which we hate, and we take every single false rejection that we discover seriously, knowing that there’s another founder at the other end of the line. We try to make it easy to get in touch with the humans at Stripe, me included, to maximize the number that we discover and the speed with which we get to remedy them.

* When these mistaken rejections happen, it’s usually because the business (inadvertently) clusters strongly with behavior that fraudulent users tend to engage in. Seeking to cloak spending and using virtual cards to mask activity is a common fraudulent pattern. Of course, there are very legitimate reasons to want to do this too (as this case demonstrates).

* We actually have an ongoing project to reduce the occurrence of these mistaken rejections by 90% by the end of this year. I think we’ll succeed at it. (They’re already down 50% since earlier this year.)

replies(25): >>28524033 #>>28524044 #>>28524048 #>>28524050 #>>28524154 #>>28524171 #>>28524182 #>>28524398 #>>28524413 #>>28524431 #>>28524441 #>>28524749 #>>28525580 #>>28525617 #>>28525758 #>>28526933 #>>28527035 #>>28527043 #>>28527233 #>>28527269 #>>28527682 #>>28528656 #>>28529788 #>>28530370 #>>28537774 #
hippich ◴[] No.28525580[source]
> Stripe can easily lose very large amounts of money on individual accounts, and thousands of people try to do so every day.

Not sure what case you refer to, but in our case someone was able to place multiple clearly (in my own hindsight) fraudulent orders on our woocommerce store. And it wasn't Stripe who lost on these chargebacks - it was us. The only way for Stripe to lose money in such scenario if seller (us) would be an active part of the fraudulent transaction. I.e. work together with someone placing fraudulent orders and immediately funnel money away and throw away stripe account. That is clearly not an option for an established business...

And no, it wasn't a niche attracting fraudsters - we sell pyrography tools, not electronics or some other similarly attractive products for fraudsters.

replies(1): >>28526336 #
danielmarkbruce ◴[] No.28526336[source]
You figured out a way to do it (and people will set up businesses solely to do this) without having to think too hard. The creative things fraudsters will do is pretty wild. The time horizons they'll work on is also surprising - sometimes they move fast, sometimes they are quite patient and pose as an established business. And... sometimes they start out legit and then go to fraud when their business starts failing.

Give these guys a break - they are trying to onboard customers as fast as possible to reduce the headache involved. The only way to do it is automation. There will always be cases where things go wrong.

replies(1): >>28528414 #
1. fragmede ◴[] No.28528414[source]
And sometimes the scammers will buy legit, aged accounts, or take them over, so just because an account has been in good standing for years, with what looks like real human interactions with support, isn't enough of a signal to know that a scam isn't taking place from that account.