We've been targeted with a credit card testing fraud attack on Stripe
twitter.com
twitter.com
Contacting Stripe back then was a complete waste of time.
We implemented a bunch of rules manually which mostly fixed the issue and I reached out to support to ask if there was anything else we should do.
A few days later they said we need to "take immediate action" and offered only generic advice.
I told them what we already did (implementing the Radar rules manually) and they said oh yeah seems fine, looks like it stopped. But the kicker is we did that before they reviewed our account and told us we needed to take action. What a joke.
This was after spending tens of thousands in fees in a single month with them.
The only reason some of these payments went through this week is because of the ridiculously low Risk Score that Stripe assigned some of the payments so our rules weren't triggered (why worry about a transaction if Stripe gave it a 0 out of 100 risk score?)
I really want to know how Stripe can assign a ZERO risk score to a customer using a card from a different country from the IP, with the wrong country in the billing address, with no CVC pass, and with a lot of related failed payments from different cards associated with the same IP/email. Madness.
The team is digging into why the risk score is low. In general, the types of signals you describe weigh pretty heavily in Radar’s risk assessment, and should result in higher risk scores. In this particular attack, fraudulent actors are using some pretty sophisticated scripts to try and obtain lower risk scores. We’re iterating quickly to address and stop these types of attacks and score them correctly going forward.
Stripe will not eat the fees for card testing.
Also, it is mentioned in the thread they are using Stripe Checkout (we are too)
We're not using any other API from Stripe other than that required to launch the hosted Checkout page.
Contacting Stripe about this (this was about 2 years ago) -- apparently this was all my fault -- despite CashApp "bank" accounts being bastions of fraud, and the credit card transactions all being from a single IP address. And I was given the run around since it wasn't my bank account used for the EFTs, so I didn't have a "fraud" claim and the stolen credit cards weren't mine either. But I was left holding the bag. Stripe took the negative balance out of my bank account.
Basically fraud is my problem even though their systems enabled it (for real, a simple check of an account routing number shows that it's the holding bank for CashApp, yet they allowed the EFTs without even the most cursory hold) -- but Stripe for years had no problem getting my more than 3% in credit card fees. Also the transaction size was far different than the typical transaction size that occurred for multiple years. But yeah, I get it, it's all my fault.
I contacted law enforcement with extremely detailed logs, even the geographic area where the transactions happened (down to the block of a neighborhood in Florida.) I contacted Stripe, I contacted CashApp. And nobody gave a shit because it wasn't their money.
If Stripe were on the hook for the fraud, I'd bet their systems would get really good in a hurry. As it is they not only didn't have any liability, they also made money from me on the chargeback fees. And CashApp doesn't care because it isn't their money either.
I'm working on a new startup project now and Stripe is not on my list of payment processors. I will never use anything Square-related ever again either. I realize that the others probably aren't any better, but that there was no empathy (and for weeks after, attempted fraud with Cash App banks accounts continued to be attempted, but I had manually blocked transfers to that specific routing number in my application code -- so I saw the fraud attempts continue long after.)
Basically Stripe facilitated money laundering and then left you on the hook for it while happily taking fees from you
I think of these "online wallet" services as effectively "VPNs for money": they give a fraudster who wants to get around some other form of blacklisting, as many additional credit card numbers to spread their tx volume across as they like — all with arbitrary credentials (because these cards are issued by "online banks" who never see their customers in person, so it's very easy to register accounts with purchased false identities. And people also just resell them: https://wmcentre.net/en/item/papara-vasha-turetskaya-zarubez...)
If I can block Tor IP addresses in Cloudflare, why can't I block these "money VPNs" in Stripe?
I'm not saying that fraud is an easy problem to solve, but I think you're absolutely right that this is a case of misaligned incentives. If it were Stripe's liability, it would get solved for _everyone_, rather than being in this middle ground where if you're lucky you might get help if you post on HN
What's the incentive for them to give you an accurate score if they make money anyway?
More broadly, we’ve seen an uptick in card testing attempts across Stripe. While the absolute rate of successful card testing across the Stripe network is flat-to-somewhat-down, it’s not evenly spread—some businesses are seeing more than others. For these new testing attacks, we’re deploying mitigants in real time.
Also, after posting this thread I just had to refund two more payments from an Indian IP address using a Singapore card with a billing address in the USA with a ZERO risk score. How does that make any sense? There is no CVC check listed and the zip check is "Unavailable"
I simply don't understand some of these scores
How could there not be a minimum risk score in a situation like this where none of the countries even match up...
I agree with you, it's very counter-intuitive why these transactions are getting through Radar. We're iterating on some fixes right now that should stop this going forward by addressing this type of attack.
New small businesses, particularly those that are potentially having a spike in sales (anything AI right now) are a good target as the operators may not have put into place their own monitoring and mitigation yet, but they have enough volume not to trigger an auto lock from the card processors.
Personally I have found Stripes fraud protection better than the competitors, however this thread has some good points about how some of these payments should have been auto-blocked.
I'm looking at a payment I refunded today with a ZERO risk score.
1 minute before this one went through, the same Stripe customer tried a different card and it was blocked with the message "Don't tell the customer that the card was reported lost. Instead, direct them to contact the issuing bank."
The same IP address has THIRTY blocked payments using dozens of different cards over the course of 2 hours.
Their IP address is in the USA and is a VPN. The card originated from Singapore. Their billing address is the Philippines. The name they used is "jake smith".
Again, ZERO risk score out of 100 from Stripe. What the hell...
This makes it less clear that it is happening to more than a single company and the way it is quoted makes it sound like I am the same person as the Twitter poster
The way I've made peace with it is to think "not my platform, not my rules", and let others change the title to whatever they please.
We found them to be coming from the same email address. Even when we removed the customer from our system, they'd create a new profile with the same email. To solve the problem in the short term, because they insisted on using the same email every time and were being absolutely relentless - whenever they logged in to a profile with that email, I redirected them to a dummy checkout page. That bought me enough time to write some rules that if someone makes more than X simultaneous connections, it blocks their IP and presents a "please call us" message.
They've tried about a dozen times in the last couple weeks, and they keep shutting themselves down by trying to scale up to a ridiculous number of connections.
The behavior seems strange. They insist on using the same email address and they do nothing to change their approach.
Is there really nobody you can pay to do the credit card derisking for you?
There is an infuriatingly high amount of obviously fraudulent charges though with a very low Stripe risk score that only custom rules catch.
Thank you to the Stripe team for finally taking this seriously and stepping in to resolve this. My guess is that prior to today, this was never elevated to the proper people for real action.
Until then, if your name is Jake Minas and you're trying to get a subscription: I am sorry.
Basically, someone farmed a bunch of numbers, sold it to someone, that new owner is now testing them to see if they can sell them further to others / launder the money off them.
Also what is up with their risk score in situations like this: https://news.ycombinator.com/item?id=36197303
This situation can still happen exactly in a crypto world, but it’s the consumer getting screwed instead of the business.
In a crypto world, a consumer would have their key pair stolen and immediately be completely broke because everything can be instantly and irrevocably stolen.
CCs have chip mode. Chip mode transactions are impossible to spoof. They are one time transactions protected with nonces and very good cryptography. But CCs have a weakness when used online because you have to enter in your secret numbers to use them. When these secret numbers are entered into a fraudulent website, that bad actor now has access to your card _until the CC company stops it_, either at your discretion or their own.
Crypto is quite fancy, but you can’t solve wrench problems [1] with technical solutions. Consumers are still going to fall for phishing attacks, they will still accidentally loose their keys. The only difference is the consumer has no recourse. They are good and properly screwed.
Example: someone holds you at gunpoint and demands your secrets. With CCs you just hand them over, then as soon as you can call in and dispute all charges. If a guy with a gun demands your pub/private Keys, I’m not sure what you would do.
I supposed that is a boon for business, and business rules America, but unfortunately this is another problem that crypto does not solve.
Cryptocurrency does not actually solve this problem. It just gives people a greater incentive to push through the pain of solving this problem.
Crypto maxis always like to argue that crypto theft isn't possible, but the reality is it happens a lot and there's no recourse when it does (which is what makes it an attractive target).
The two arguments I often hear are "losing keys", which would not be a big issue for small amounts, and "fees", but that is avoided via the Lightning Network these days.
Is it that every payment is a taxable event, so it is too cumbersome for the customer because of taxes?
Especially with no dispute mechanism either.
So no thanks to crypto at all.
Consumers largely don't want a "got scammed? you're fucked, no chargebacks!" payment method.
The AI projects in the link all have some reputation behind them.
You can make a mistake or get scammed using well-established websites, after all.
It doesn't actually solve anything from a KYC or trust perspective, which is at the root of lots of these problems. A good interaction is "I, the buyer, have money, you, the seller trust me that I have the money that I am digitally transacting to you. After the sale is made, the transaction clears, I have less money, you have the money instead." This contract breaks when either side doesn't do their job -- provide the money for the service, provide the service for the money. BTC doesn't solve this for both parties.
As a seller, I don't have to implement PCI compliance, deal with an acquirer bank to process transactions, fraud checks, whatever - I link up the Paypal/Stripe/... account to my shop and that's it.
And as a customer, I don't need to trust Joe Random's webshop with my CC details, and I have a reasonably well working customer support when the seller turns out to be shady.
C'mon don't be disingenous.
you need easy ways for people to get into Bitcoin. A CC (or in Europe, SEPA direct debit) is easy, customers are already used to this, and it works hassle-free.
Meanwhile, Bitcoin? If you're not set up with an exchange already, you need to set up an account, pass through KYC crap which may take hours, and only then you can pay. The only kind of services worth that effort are truly anonymous VPNs and servers or drugs.
Bitcoin is pretty high friction, and comes with a bunch of downsides (no recourse for errors/scams, value volatility, etc.) that are important to some people.
Not to mention that the cryptocurrency world is generally full of shady actors and many simply don't want to be associated with that.