Stripe has decided to nuke my entire business

The worst part about these type of cases is not being able to get a straight answer. There is a whole subset of big tech that has taken the "you must be a fraudster therefore we can't unfuck the situation" approach to customer support.

It's an arms race with fraudsters that eventually sucks in legitimate businesses.

IMO it is not the "you must be a fraudster" logic as much as "we have enough other customers that we can burn you without much worry of repercussions".

As much as I hate government intervention in business, it really seems like there needs to be a way to force companies to actually be direct, accessible, and reactive in cases like this. I went through something similar with Venmo randomly locking my account after I received a large-ish payment, and not getting any real action or sense of urgency on their side.

I hate seeing comments like this because Stripe’s hands are tied here. Anytime a bank or payment processor has frozen or shut down an account and you’re getting stonewalled it’s almost guaranteed to be an AML related issue and it’s against the law for them to tip a customer off that their account is being or might be investigated for suspicious activity. This isn’t Stripe deciding that you’re a fraudster and so you’re undeserving of help. This is Stripe doing business in compliance with the law. I’m not saying that makes it acceptable but if you’re upset about the behavior described in this post call your Senators and Representative to complain about the Bank Secrecy Act and the USA PATRIOT Act; they’re to blame for this sort of frustrating non-response.

This seems similar to anti-trust in a way. Taking a wider view of anti-trust, the goal is to keep the market healthy by ensuring there are choices available to consumers; there are no unhealthy monopolies and anti-competitive practices. Well, as a consumer I would like to be able to choose tech products where I can get effective support. Customer support is lacking in some markets, it's not healthy. The anti-trust fix is to bust up a company, but I don't see how that would help here. This is a new economic problem where dominant companies are run by computers and algorithms that serve 95% of the people, but if you're in the unlucky 5% you're screwed.

Sure, and my experience is outside finance (more spam and fraud prevention).

Even if it is government under the hood you have to know what you're accused of. Not American so I doubt the US political system is interested in hearing from me, but I agree that's the only way of solving the deeper AML problems.

It's the YCombinator startup way: scale large enough so that you don't have to worry about customer complaints until they threaten to go public and generate enough press to cause real damage.

But in all seriousness, being a YCombinator startup is now a big red flag outside of the VC-funded bubble. My current employer, and the previous one, have strict no-YC policy for SaaS due to numerous issues with previous YC companies. And these are both tech-friendly/tech-adjacent companies.

It's even worse at stodgier companies; an executive sees "Stripe froze my payments" and that's what they remember when a Stripe salesman tries to pitch them on using stripe for their online store. Stripe is quickly becoming Google, in the bad way: it's a name people are learning to avoid, and if that hits critical mass they're dead.

>it really seems like there needs to be a way to force companies to actually be direct, accessible, and reactive in cases like this

That's what SLAs/contracts are for.

Yeah, I had a trouble with Wise (formerly transferwise), with a rather large payment. The annoying thing was they delayed the payment of the 10% deposit, I sent the contract, approved, and then a month later they held up the balance as well.

I still love them. That issue aside they allow me to have a personal and business account in multiple currencies, and don't screw me on the exchange rates.

This is the first I've heard about a "no-YC policy for SaaS" outside of my own employer (after three back-to-back horrible experiences) but glad to see it's catching on.

As executives and purchasing managers get more tech-aware I think we're going to see an increase in due diligence into who is running companies, who their investors are, what other companies they've invested in, etc. Brands like YC will end up getting punished (and all their portfolio companies, by extension) for the bad actors.

> it’s against the law for them to tip a customer off that their account is being or might be investigated for suspicious activity

What law do you think forbids this? In my experience running global payments through multiple rails, on an OFAC/risk ping you typically get a request for enhanced due diligence, which normally looks to the payee like “send me a picture of your drivers license”.

The most common result is that O Bin Laden (matching the OFAC list) is actually Oscar bin Laden; with further info you disambiguate the payee from the OFAC listed entity and are allowed to transact.

I have never encountered a reg that says you are obliged to ghost your customer.

> Even if it is government under the hood you have to know what you're accused of.

This is exactly why the whole process is suspect. The government farms out the policing of certain financial crimes onto the financial institutions as a prerequisite for operating the business. If the government came along and froze your bank account you’d have a right to ask why and a right to get some answers. But instead the government pawns the responsibility off onto businesses and then prohibits those businesses from telling you why.

And so the BSA and Patriot Act effectively allow the government to take your property and take away your right to confront the government about why they took your property. And it’s all on merely a vague suspicion of misconduct. No proof whatsoever.

I can’t help but laugh at the irony— the federal government laundering their otherwise unconstitutional activities through the banks.

I don't think that's accurate.

I do some payments that are ridiculously suspect but legal.

I have never been completely blackholed and given robot responses, any time a problem comes up.

Stripe is lower margin than other banks/payment providers, so they don't look very hard.

They have a very strong incentive to throw away troublesome customers, which they do.

I don't think it's right to say Stripe's "hands are tied".

They could spend more to identify false positives, but they don't.

If I used Stripe for all of my transactions I would be blocked. I know this because I have 100% confirmed this from an inside source at Stripe and at a countries central bank.

Yet somehow I have and continue to maintain accounts with other banks without breaking the law.

The Bank Secrecy Act. And I don’t “think” it. I know it.

I'm trying to understand your position here:

You think AML/KYC laws, as they currently exist, are unconstitutional?

edit:

That's a fine position to have, but it's a fringe one, and I don't think you should be offering it as a reason why Stripe does what it does that's generally accepted by everyone else.

The problem is that Stripe has identified you as possibly being a fraudster. Any information that they give you about what they suspect and why is information that a real fraudster could use next time to try and evade the detection algorithms.

It is like this with virtually any security system. Adding feedback you can use for debugging also makes the system much easier to compromise.

Which bit of the BSA?

edit: As I re-read the thread I see that I am thinking more of onboarding KYC, as opposed to this case which would be ongoing-activity investigation. So that would explain the difference in expectations here. Still interested in learning more about the regs for ongoing investigations if you have time to share!

In the UK at least, section 333A of the Proceeds of Crime Act 2002? (Disclaimer: not a lawyer)

See https://www.lawsociety.org.uk/topics/anti-money-laundering/t...

No. I don’t think it’s unconstitutional which is why I said “otherwise unconstitutional”. And you’re (perhaps deliberately) completely misunderstanding and conflating my two comments. I am quite confident that OP’s problems with Stripe are AML related which is not at all a “fringe” position.

The bit at 31 USC § 5318(g)(2)(A) under the title “Notification prohibited.” FinCEN has also promulgated confidentiality rules thereunder. I don’t have a pincite for that but I believe it’s tucked amongst their record keeping rules.

At which point YC will come up with an algorithm to evaluate companies and blackhol certain companies without warning or process and we'll see HN posts "YC just blackholes my business!" but on Reddit, since they won't be able to post here.

Not to put on too much tinfoil but the government probably benefits from opaque ban processes in large oligopolistic private companies. “It’s private enterprise, sure we may request it periodically but their cooperation is entirely voluntary based on their civic pride.”

I think it is called GDPR in Europe

Depending on amounts, small claims in the US might be viable.

> we have enough other customers that we can burn you without much worry of repercussions

This. This is a common tune to about 100% of "BigSomething killed my business" stories that appear on HN almost weekly. If you go to BigSomething, you get a polished, automated, convenient, cheap service that would not hesitate to kill you account the moment something looks wrong to any of the robots watching it, and the customer support (the non-robotic kind, I don't count "we are working on it" auto-replies) is not part of the package because it doesn't scale. You have to either accept this as the risk for doing business, or not use BigSomething as you primary or critical vendor.

Interesting to notice the censorship of speech on social media is implemented the same way. The government does not remove undesirable information directly, instead it calls up all major platforms "for a chat" and tells them to voluntarily remove it, or face Congressional hearings and likely further unpleasantries down the road. An offer they can not refuse. Looks like they think they found a loophole in the Constitution and they are going to mine it for all the power they can get from it.

And the inevitable calls for HN to be made a public utility.

Part of what makes these situations so frustrating is that there's no due process, and there are significant ramifications to your livelihood. You aren't told what you're being accused of, you have no way to contest the allegation, and you might lose your entire business over a clerical mistake.

Making competition easier in this space is another way to solve it. If Stripe had 15 competitors all of whom were API compatible so you could switch in 5 minutes, any bad PR would drive customers away in droves.

Government has made entry to this space hard which is why there aren't enough competitors, so they're really the source of the problem.

Wouldn’t that only apply to investigations by e.g. Fincen? How many of these are just internal risk triggers by Stripe? Why would they have to stonewall you in those cases?

(Obviously it’s quite difficult to know the ratio of cases like these involving government investigations and those involving their own internal risk procedures.)

Might be time to build an analytics.js equivalent, but for payment processing. A single API lib that you can then use to process payments with Stripe, Braintree, etc.

Government hasn't made entry to this space hard, the banks that Stripe partners with have. Because they don't want to deal with high-risk transactions. They are the gatekeepers here, and Stripe has to bend over backwards to make them happy. They'd much rather burn individual customers, than jeopardize their entire business.

How many fraudsters are maintaining a business relationship for 6 years? 6 years! And the OP doesn't even get a courtesy phone call before termination. That's messed up.

From what I understand, the government introduced legislation sometime in the past 20-30 years (Was it the PATRIOT act? I can't remember) - which I believe put the onus of blame on the credit card processing companies instead of the government when it came to fighting fraud.

I assume the government didn't want to put all the work in of making sure the currency they've societally coerced the world to use isn't being used for fraudulent transactions, they'd rather pawn it off onto the banks because it's easier for the government to not do anything about it.

Now the banks have been shooting anything and everything that has even a semblance of fraud with account locks/funds freezing/etc., because if they don't the government will go after them.

How does this system make any sense to anybody? So frustrating. Let me exchange currency with anybody for any reason at any time.

Those laws certainly feel like guilty until proven innocent or in many cases, guilty no chance to prove innocence.

Being direct, accessible and reactive at scale when you’re processing billions of dollars of transactions simply is not possible.

Stripe and other companies are doing their best, but they are in an arms race with more and more elaborate fraudsters. At planet scale.

Certain banking regulations make those transactions "high risk".

Some of them are due to government regulations like 'don't launder money' and 'don't process money for illegal activities'. Which are, like, basic operations of society 101 level stuff.

Others (adult services) are not due to government regulations, they are there simply there because banks don't want to deal with chargebacks.

This could be a simple regulation - put a burden of proof on the company, and a prescribe escalation process with comment from the customer at each stage.

The crime of "money laundering" was invented out of nowhere one day. Society predates it by thousands of years.

right a company that makes billions of dollars can't hire more people to staff up their risk/compliance/fraud teams

> Some of them are due to government regulations like 'don't launder money' and 'don't process money for illegal activities'. Which are, like, basic operations of society 101 level stuff.

Except the operationalization of those rules is: here are some vague guidelines that you have to follow, and if we don't like you we'll retroactively decide you were committing a crime even if you followed those guidelines to the letter. See HSBC for a case in point.

While this is clearly "a thing", I would be a fine bottle of wine that the OP's issue is not one of those things, and is just some dumb algorithmic or overworked fraud prevention contractor problem.

I would bet that 99.9% of the Stripe (and Paypal) horror stories that get posted almost weekly are _not_ federal money laundering or terrorism financing investigations with legal secrecy provisions imposed on the payment processor.

The answer is, "A lot more than you think."

One of the attacks that fraudsters have developed is to buy businesses to use their accounts for fraud. That going out with a fraudulent bang is better than trying to run a marginal business.

> I am quite confident that OP’s problems with Stripe are AML related

I'm curious as to why you think that? Is this a way way more common thing than I expect? Or is "My startup uses Stripe Connect to accept payments on behalf of our clients" a raging red AML flag I don't recognise (I've never done that, so it could easily be)?

Ha! Clearnet exit scams. Kinda an obvious thing in retrospect. Of _course_ somebody was going to try it.

+1 "Oceania Has Always Been at War with Eurasia"

"Let the fires burn."

Onboarding new customers looks better and gets more funding than maintaining quality for existing customers, so they just don't care.

>almost guaranteed

The issue most people in this thread are talking about exists in the almost. If it was always guaranteed, then there would not be so much evidence to the contrary.

Exactly. Not fringe. Part of the normal struggle for existence.

Unless you are a federal prosecutor, law enforcement officer, or bank executive that has actively worked on a Bank Secrecy Act case, I don't think you can authoritatively state that this sort of cowboy-style, "Move Fast and Break Things" way of blitz-scaling revenues while downscaling customer service favored by companies such as Stripe has ANYTHING to do with the Bank Secrecy Act.

If anything, I would bet that regulators would be concerned about the fact that companies such as Stripe have triggered a race to the bottom whereby underwriting has become an after-the-fact exercise that can severely damage and/or kill a high-growth SME. The old way, where you filled out a ton of paperwork, provided every bit of information possible about you and your business, and then went back and forth with a human to get approval, was a much more stable way to business. But alas, when you've got former bank governors on your payroll and political mega-PAC donors on your cap table, people don't scrutinize very much.

That does not scale with the fraudsters. To have zero situations like OP is describing, Stripe would need to linearly scale its support team with the number of fraudsters, which would make their business simply non-viable.

This would be the same as saying: I want zero car accidents on the road, so I'll scale the police headcount linearly with the number of reckless drivers.

It'd be unconstitutional, were the government in charge, without due process.

I am indeed more than qualified to “authoritatively state this”. Even by the ridiculous standards you’ve outlined. And I would be more than happy to take that bet.

I’m confident it’s an AML issue because they’re getting stonewalled which is standard operating procedure when a Suspicious Activity Report has been filed. I don’t think using Stripe Connect is the red flag.

The thing with SARs is that they tend to be cascading as OP described. So if I (innocently and totally coincidentally) do a transaction with someone who has been flagged for suspicious activity my account might now be flagged as “higher risk” for suspicious activity and will be monitored more closely.

And, if they decide they’ve found suspicious activity in my account then everyone who does business with me is at risk of having their accounts flagged as “higher risk” for closer monitoring and so on.

And the bank isn’t allowed to tip anyone off because if any of those accounts are actually laundering money they might suddenly withdraw it and then the “lead” from the SAR is moot. It’s actually a crime to notify someone about the suspicious transaction(s). Which is why you get stonewalled.

So you’re stating that you have been involved in a situation in which a merchant account was frozen due to circumstances involving the Bank Secrecy Act? I just want to be completely certain that this is the assertion?

> Some of them are due to government regulations like 'don't launder money' and 'don't process money for illegal activities'. Which are, like, basic operations of society 101 level stuff.

No, that's wrong. Firstly, as others have pointed out, society long predates any such notions.

Secondly, determining what is illegal activity, and putting a stop to it, is ostensibly the job of law enforcement and the courts, not the bank.

Thanks!

For anyone following along, text at https://www.fincen.gov/resources/statutes-and-regulations/ba... > https://www.govinfo.gov/content/pkg/USCODE-2020-title31/pdf/....

This is for SARs (Suspicious Activity Reports). (At least, that's the one I've encountered before, there may be other forms too).

Are we still pretending that USA government is a distinct entity from USA's large corporations? If the banks didn't like the regulations, the regulations would change. If some random elected official didn't like how the banks operated, after the next election she would be an ex-official.

And that day was less than 100 years ago. "Money laundering" as a concept was invented during the Prohibition (as were a lot of other private rights violations) in order to not let alcohol sellers - which the government was not able to prosecute directly - to use their money. But most of the current US AML regulations are based on the Bank Secrecy Act from 1970.