Hacker News Reader

Comment by umziehennachbar | Hacker News Reader

If $6 is too cheap and encourages fraudsters to test credit cards on your service because banks don't get concerned about transactions at that cost, how much should he have charged at a minimum? $10 $20?

View on HN

It was £6, which is closer to $10 USD. But good question.

Could you require the first payment to be for say three months upfront, and rolling monthly after that?

Or discount quarterly billing and hike the rolling monthly above the threshold?

I wondered that myself, especially since it doesn't have to be more expensive to the end user. Instead of selling them 1 month for $6, sell them 12 for $72 or some such, or make them buy a minimum of 10 accounts to get a monthly rate.

Yah, I know the trend is to do a bunch of little micro payments, but its not like you can't do the math for them an say "$6 a month" then when they go to order it, limit the minimum number of months in order to increase the total.

does Fivvr.com experience this problem?

Fraudster doing credit card tests is something that happens everywhere. This is not specifically related the the type of service or to the amount charged.

Everything < 50€ / $50 / £40 will hardly trigger any security measures.

A good way to counter testers is to add a delay to charging the card.

what does that mean? Please describe

Give your users something like "first two weeks free", which will annoy the fraudsters who want the charge to go through immediately.

but then doesn't that require you to hold onto the credit card details to process two weeks later. One of the attractive features of stripe is that you don't store cc details on your system but rather they get passed on directly to Stripe. if you implement a delay, you have to hold the credit card to charge later

No, you tokenize the card through Stripe immediately and then charge the token 2 weeks later. You don't have to hold on to the card details.

so after you charge the card two weeks later, the transaction still gets completed unless you've somehow figured out during the two weeks how to determine whether \the attempt was fraudulent. I don't think this strategy will work because it will depend on the fraudsters knowing that the payment won't be processed for two weeks and then deciding it's not worth it. Are they going to read the TOS?

If the UI makes it clear that they aren't charged for two weeks, they likely won't bother waiting and move on to target a different service.

they also might see an advantage in the delay that you don't see and try it out.

It looks like Stripe can defer payment for 7 days:

https://stripe.com/blog/auth-capture

That's quite clever.

Reply on news.ycombinator.com