←back to thread

Update: Stripe is holding over $400k of mine with no explanation [resolved]

501 points eeemmmooo | 4 comments | 03 Jan 23 15:52 UTC | HN request time: 0.621s | source

This is an update to my previous post https://news.ycombinator.com/item?id=34189717 . Stripe has resolved the issue and everything has been released. I told the contacts at Stripe that I would do a write up about what happened from my point of view to help them understand what happened to me. I figured it would be good to do that write up publicly to help both Stripe and potential Stripe customers understand what happened and how it was resolved.

Summary: Stripe put my accounts in review for a spike in sales on Cyber Monday. Throughout the month we received very little communication from Stripe and had many support chats and calls. Keep in mind that the whole time Stripe was still accepting payments on our behalf on all of these accounts. Each of the chats/calls asked us to upload the same invoices each time for review and gave us vague information that our accounts were being reviewed. Finally out of frustration I posted on HN about my issue. Thanks to @dang for getting a Stripe employee to respond and he was finally able to resolve the issue for me.

Overall this review process was pretty bad. Very little communication and nothing I could really do directly to move things along or get any real information. It took a random Stripe employee to get an email from @dang and post on HN in order to get this issue resolved. I’m lucky because I know about HN and know that Stripe employees frequent the site, but I don’t think HN wants to become the Stripe support forum.

Stripe you can do better. We all know that in order to scale you need to automate pieces of your infrastructure and communication. But, there is a balance between automation and manual review. When someone like me gets caught up in an automated system there needs to be better ways of letting support help that person.

See my comments below for actual details and dates.

1. lol768 ◴[03 Jan 23 16:07 UTC] No.34233240[source]▶
> But, there is a balance between automation and manual review. When someone like me gets caught up in an automated system there needs to be better ways of letting support help that person.

This keeps happening, again and again. It's not just Stripe, Google is a huge offender when it comes to automated decision-making and next-to-no human support when it inevitably goes wrong.

GDPR explicitly requires that companies provide a right to human intervention to data subjects, and this is the sort of regulation that needs adopting in other jurisdictions:

> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

> In the cases referred to in points (a) and (c) of paragraph 2 [explicit consent given/necessary for contract], the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

replies(3): >>34233328 #>>34233373 #>>34233453 #
2. miohtama ◴[03 Jan 23 16:13 UTC] No.34233328[source]▶
In the case of finance, anti-money laundering laws triump GDPR.

If you as a financial institution suspect money laundering by your client i.e. a spike in transaction volume, you as a financial institution have an unlimited time to not to reply, can freeze the assets and cannot be held responsible for any inconvenience. Even suspecting money laundering is enough, you do not need to have an evidence. In fact it is opposite and it is a criminal offensive to tip off anyone about AML issues. The law is very one sided.

https://www.mondaq.com/cyprus/privacy-protection/1008074/gdp...

3. mytailorisrich ◴[03 Jan 23 16:16 UTC] No.34233373[source]▶
Of course none of that applies if the Stripe account belongs to a business as opposed to an individual.
4. soco ◴[03 Jan 23 16:20 UTC] No.34233453[source]▶
I imagine once you're locked out of the account whatever that is, relying on GDPR will mean getting a lawyer and all that - by no means a quick or cheap way to sort out your problem. GDPR will only be helpful after applying enough fines and lost processes, finally forcing Google/Stripe/etc to rethink their support strategy. Which means continuous hassle for today's customers and blaming GDPR for being "toothless" (blame set usually by the same people which claim the invisible hand would sort it out automagically).