Hacker News Reader

Comment by Cerium | Hacker News Reader

Same here, they used to but stopped about a year ago.

Ditto. Helping some non-profits, we were really hurt by people typo-ing a $10,000 donation when they meant to only donate $100. We quickly learned from that mistake.

We also learned about how credit card thieves test credit cards. We saw hundreds of donation attempts. Stripe had us refund those that went threw, which costed us money in fees. Fortunately we were able to put some quick measures in place to stop them temporarily & then better measures for long term success.

I am curious what measures did you put in place?

The credit card tests had unique network patterns we could block.

We lowered our online donation limit. Above a certain amount it really is more ideal for a check or some other type of transaction. Though we've had a few people offer to just pay the 3% transaction fee on top of the multiple thousand dollar donation. For those we do a bit more manual process.

For a cost, Stripe also lets you put some additional rules on what type of payments you'll allow & how much info the person has to verify for the payment to be accepted.

We actually raised our minimum online donation limit to avoid issues with those processors. They apparently look for set your own donation sites so they can try to authorize $1 test payments. We changed to a $10 minimum and they seemed to have stopped.

Thank you. It all makes sense. Did you end up using Stripe Radar to check for fraudulent payments? It is working well?

Yes & yes but your mileage may vary depending on your customers/donors. For example, we turned off transactions from several countries.

Honestly a basic version of this should be free. I shouldn't have to pay extra to say I only accept cards with a CVC number & expiration filled out.

I agree with this. I am a bit frustrated with Stripe for making this a paid service given the cost of payment processing. However, I assume when the fraudulent transactions cause a loss you have to pay for Radar.

A common way to prevent that is to authorize only first - settle/charge that payment at a later time when you think it's not a typo.

Reply on news.ycombinator.com