Hacker News Reader

credit card numbers tend to require proper PCI compliance and audit. Storing credit cards is quite the liability, and unless I know I can trust the company entirely, they won't be getting any credit cards.

View on HN

We don't collect CC directly, we redirect users to Stripe Checkout page (so not on our website anymore) and we get a webhook from stripe with a token of the CC and no details about the real CC number... It's pretty safe and that way we dont need to be PCI compliant

Okay - would be useful to mention, you don't process the credit cards on your own. But in that case - ask for minimal payment and possibly offer a refund. You can honor 2 weeks refund,

Personally I will be much more ok to pay a trivial sum to try out something than just have my credit card.

how many legit users are turned away when asking for CC vs how high is the abuse ratio? maybe try to find out when the legit users turn away. maybe they are not satisfied with checkout process?

Most companies shouldn't be storing CC numbers in this day and age but using tokenized cards instead. Let Stripe worry about PCI compliance, and OP can simply advertise which processor they're using so customers feel secure.

Indeed, this is exactly what we are doing with Stripe

Reply on news.ycombinator.com