Update: Stripe is holding over $400k of mine with no explanation [resolved]

[eeemmmooo]

This is an update to my previous post https://news.ycombinator.com/item?id=34189717 . Stripe has resolved the issue and everything has been released. I told the contacts at Stripe that I would do a write up about what happened from my point of view to help them understand what happened to me. I figured it would be good to do that write up publicly to help both Stripe and potential Stripe customers understand what happened and how it was resolved.

Summary: Stripe put my accounts in review for a spike in sales on Cyber Monday. Throughout the month we received very little communication from Stripe and had many support chats and calls. Keep in mind that the whole time Stripe was still accepting payments on our behalf on all of these accounts. Each of the chats/calls asked us to upload the same invoices each time for review and gave us vague information that our accounts were being reviewed. Finally out of frustration I posted on HN about my issue. Thanks to @dang for getting a Stripe employee to respond and he was finally able to resolve the issue for me.

Overall this review process was pretty bad. Very little communication and nothing I could really do directly to move things along or get any real information. It took a random Stripe employee to get an email from @dang and post on HN in order to get this issue resolved. I’m lucky because I know about HN and know that Stripe employees frequent the site, but I don’t think HN wants to become the Stripe support forum.

Stripe you can do better. We all know that in order to scale you need to automate pieces of your infrastructure and communication. But, there is a balance between automation and manual review. When someone like me gets caught up in an automated system there needs to be better ways of letting support help that person.

See my comments below for actual details and dates.

[cj]

This reminds me of an issue my sister is having with Etsy.

She runs an Etsy store with $1-2 million in annual sales, and her store keeps getting taken down by Etsy's automated copyright infringement system -- which keeps getting triggered by someone submitting fraudulent copyright claims and then immediately asking her to pay $5k/month in exchange for the person to stop submitting the infringement claims (in other words, she's being extorted).

Basically Etsy immediately takes down listings with no human review upon receiving a copyright complaint, which can be used by black hat scammers to extort stores into paying $5k-10k/month in exchange for the black hat to stop submitting fraudulent claims.

It's really astounding that companies build these automated systems that hurt their customers with no humans on standby to resolve these kind of edge cases (false positives).

[neilv]

If this extortion practice isn't a common curse of Etsy stores with her scale of revenue, I wonder whether it might actually be a competitor (who gets the sales and customers whenever her store is down).

[gamblor956]

That is extortion.

Your sister should contact the FBI, as it is unlikely that she is the scammers' only target, and this crime likely crosses state (or international) borders.

[MerelyMortal]

It might be too late now, IDK, but perhaps she could lie and tell the attempted extorer that she already pays another extorter and can't afford to pay two extorters at once, and if they keep taking down their store, she'll tell the extorter that she can no longer pay them because of them and do they want another criminal coming after them?

[yarg]

It's not that astounding. The simple truth is that customers are not valuable enough to warrant human interaction.

Cheap and scalable server time? No problem.

Communication with actual people? Not unless there's an exodus of customers (and even then you're not big enough to matter).

[bread90]

What does she sell on her store?

[DevX101]

I'm glad your issues were sorted, but I'm uncomfortable with the idea that you need to make a social media post to get a customer service issue resolved. This isn't just stripe. I see this with many other companies on social media. I don't post on Twitter, and I'd rather not put my account details for some service I use in a public forum.

It's starting to seem like for too many companies, resolving public complaints has become a line item in the marketing budget.

[ghoomketu]

> Thanks to @dang for getting a Stripe employee to respond and he was finally able to resolve the issue for me.

I think it's time to add another HN tab called Complaints where we can post complaints for the common culprits like Google, Stripe, Pinboard, etc. It sounds backwards but the amount of people HN has helped over years it must add to millions of dollars to priceless things like getting back your email and photos.

Big kudos to dang and HN for standing up for the average person and being this helpful!

[jcollins1991]

I'd really love to get more insight into the Dec 30 -> Jan 3 time frame, since that's where everything meaningful happened... From the outside it's hard to tell WHY the lower level employees are completely incapable of driving a resolution, whether they're underpaid and apathetic, or if management has crippled them from making any decisions on their own. It's amazing that they don't have better processes in place after seeing HN escalation posts for years on end.

[ryandrake]

Last time I had to fight a company's customer support over them owing money to me (admittedly a couple of orders of magnitude less than OP), it was a mix of "It's someone else's fault, call them" and "Computer says no". Customer support is friendly, cheerful, and are trained to at least act sad that customer is having trouble. Lots of "I'm sorry that you are having trouble but I can't..."

Most companies' customer support seems to center around: 1. frustrate the customer with a long phone tree quest, hoping the customer goes away without figuring out and invoking the magic button sequence that takes them to a human, and 2. once the customer reaches a person, shower customer with empathy and politeness but do not solve their problem, hoping they just go away in frustration.

Customer support can generally only do "happy path" things that you can do on the web site yourself. Pay your bill? Sure thing. Read to you your account information? Of course. Fish your account out of purgatory because of a one in a million edge cases causing some sloppy code to divide by zero? No chance in hell. "I'm so sorry you are having that issue, let me please forward you to someone else..."

[phphphphp]

The cost of fraud far exceeds the cost of losing one customer. The cost of losing dozens of customers costs more than prioritising someone’s issue.

I have no insider knowledge of Stripe but I find it entirely plausible that Stripe will forever have cases like this. Serious fraud could cost Stripe hundreds of thousands, potentially even millions, and so there will always be cases that are out of the ordinary and don’t fit into the already defined processes. If you’re a low level employee, you do not want to take decisive action that costs Stripe a million dollars.

Stripe grows, fraud grows. Fraud is a cat and mouse game: the question should be, is Stripe effectively solving previously encountered problems? Given how much Stripe has grown, and how relatively consistent the number of complaints are, I’d say Stripe is doing a very good job.

I am sure Stripe could do a better job at handling these cases that fall through the cracks, but that’s a separate issue, because it ultimately comes down to having someone to take accountability and ownership of the risk. A month turnaround on this is totally reasonable.

[eeemmmooo]

Yeah I agree. There wasn't much more information for me to provide there that would be helpful. I pretty much had the same conversation the whole time. I explained the issue. They reached out (supposedly) to the review team who just told them it's under review. They asked me to upload the same invoices again. Then said they'll let me know. It just seemed like no one in that chain was able to actually do anything.

[hn_user2]

I can't see Stripe giving front line employees the ability to resolve Risk Management issues.

From the Risk Management employee's perspective, nobody gets in trouble for saying "no". Saying "no", or outright rejecting an account is the safe move for job security. And so, support tickets into these departments languish for absurd amount of times (months) at many companies.

[heliodor]

My guess is that they're measured in replies per hour instead of in resolutions per month.

From my past experiences, it's clear they don't even bother to understand what I wrote. Reading comprehension is zero, which seems to indicate a strong disincentive to actually comprehending and helping.

[jmacd]

I used to work at one of the big customer service platform vendors. We had some really, really, useful ranking capabilities that would prioritize certain customers based on the data held in a CRM. It was a bit of a pet project of mine. The idea was to calculate weights for customer importance (this can be account size, potential future opportunity size, social media following, tenure, etc) and severity of the problem (in this case, $ amount frozen..) in order to rank the service queue.

It didn't garner nearly the level of interest I thought it should/would. That was over 10 years ago though and the overall integration story probably sounded scarier than it needed to. The pitch was: Deal with big customers with big problems early (and possibly with specialized teams) so that escalations don't dramatically increase costs (they do, and the cost is usually unaccounted for).

[hn_throwaway_99]

Lots of posts here along the lines of "it's not good when you need to resort to social media shaming to get customer support", but I'll take the contrarian view, or at least explain why this dynamic exists.

The past 20 years has seen an explosion in Internet services, but a fundamental (often unspoken) quality of these services is that they must keep individualized customer support costs very low in order to be profitable. I mean, just look at Google, which has billions of end users. You can argue that Google takes in a ton of money, but it's not hard to see that if every Google user just had a single support call requiring 30 minutes of a support rep's time a year, that Google's profitability would tank (never mind the difficulty in hiring that many reps in the first place).

So all these services invest a ton into automated support and systems to ensure the vast majority of users never need support from a real human. That usually works well, except when you get some of these edge cases, and, very importantly, these edge cases are usually the worst when the customer behavior, while totally legit, "looks" pretty similar to malicious usage.

So, in that case, I'm glad that these back-channel avenues still exist when someone gets stuck in the machine. I wish there were a better alternative, but I really am at a loss to think what that could be. The social media channel essentially acts as a filter, as only things that are real problems are likely to get upvotes or lots of visibility. A trade off for users being able to get tons of value for (relatively) very cheap prices is that the "tail end" of support requests is usually pretty nightmarish.

[kcartlidge]

> I wish there were a better alternative, but I really am at a loss to think what that could be.

(This is a general comment; not directed at Stripe with whom I personally have had no dealings needing support.)

It's simple. If you can't provide useful customer service, then you can't provide a service at all. Similarly if you can't scale professionally, then in reality you can't (and shouldn't) scale at all.

Tech scales, and customer bases scale, but the real world doesn't scale with it. Professionals with morals, and standards, and pride in what they do, should self-limit their business to what they can realistically handle. And that includes the greedy behemoths across all of tech. If they truly cared about their customers they would accept that there is a limit to how many they can provide quality support for, and artificially restrict their own growth until they've ironed out enough issues that they can release the tap and scale a little bit more.

Of course financial imperatives beat both professionalism and pride in how the company operates, so that never happens.

There's no technical fix. There's no financial fix. There's probably no legal fix either. It needs an attitude fix.

[nucleardog]

> I wish there were a better alternative, but I really am at a loss to think what that could be.

Figure out what it costs to have whoever is looking at the HN issues look at them and just charge that much for a executive VIP support request.

Like, if I’ve got $400k locked up and CS stuck in a loop I’d happily drop $200 to have someone that actually has the power to talk to people and get the ball rolling on fixing stuff look at my request.

I hate the idea that if or when I fall into one of those cracks that I may not have curated a large enough social media presence to actually have it resolved. I’d love if I could just, y’know, pay for services instead.

Being willing to put some money down on it should help filter only for people that are serious and expect a ROI from the support ticket (e.g., people knowing they're committing fraud likely won't) and even if it doesn't it directly funds the support so if people want to pay you to waste your time and tell them no... well, no real loss.

[bambax]

> I wish there were a better alternative, but I really am at a loss to think what that could be.

The alternative is to empower customer support reps to look up the cause of a problem. This would not affect general operations when everything is running smooth, but would solve the case where clueless reps keep asking for the same documents and can't follow through or actually do anything.

What you're describing is how modern tech companies have eliminated support level 1.

But if that was the plan, it should be followed by making all the remaining reps level 2 and giving them the proper tools and training to do their job.

[jetrink]

I'd be ok with this if it were a tradeoff that I was choosing to make. Stripe withholding $400k can end a business. Google locking me out of my account can upend my life. I'd like to be able to pay the premium required to ensure that if an algorithm flags my account, I'm not going to be spending days banging my head against a wall trying to talk to a person who can straighten it out.

[prirun]

Except in this case, the user was actually talking to customer support, so was already taking up their time. It's one thing to have zero customer support, like Google; I can see that saving money (though it's a shitty practice IMO). But if there is a CS dept and you are talking to reps but they're not solving your problem, wouldn't it be better to actually solve the problem instead of repeatedly spending time not solving it?

[ecshafer]

I worked at a Very Large Financial Company, doing a lot of internal automation type stuff. The cost per customer interaction was very high (we didn't really outsource many things on that side due to regulations needing Series 6/7/etc). Sending mail, receiving a piece of mail, getting a phone call from a customer, all of those really cost a lot of money, and reducing those volumes, and lowering the cost were a huge driver for us. Once you include overhead and stuff, its not unreasonable that a call center employee (especially a skilled one) is costing $50+ an hour. So someone that sends in a piece letter instead of a webform, and then calls and talks for 30 minutes, that might have cost $30-50 to process all of that. It adds up fast.

[smca]

Evan, thanks for taking the time to write this up. I helped resolve your particular issue on NYE and I’m acutely aware of how painful it’s been.

I broadly agree with a lot of your statements. The lack of clear communication and the repetitive requests for information during the review process isn’t good. We’re working on striking the right balance between giving good users relevant information without giving bad actors a roadmap to defraud Stripe. And we need clear channels to escalate when users need to. While I’m happy your issue was resolved, the process isn’t where it should be yet.

[throwawayapples]

Are there any real alternatives to Stripe?

Obviously Adyen if you're in EU, PayPal/Braintree, etc, but Stripe is really the big kahuna.

What about building your own with Authorize.net? Are there any old-school gateways like that left out there that are still independent?

(can one do payments in the 10-100$ USD range on the blockchain? What if you don't want to go through an exchange?)

[quesera]

There are literally hundreds of payment gateways/processors available in the US.

Stripe is like the Heroku of payment gateways -- great to start up quickly, great business, very profitable... but customers need to be very wary of various lock in strategies, and generally plan to have multiple providers as the business scales.

[netman21]

Not sure why Square is never mentioned. I use them for my book sales. They work with Woocommerce and my fulfillment warehouse scrapes the orders three times a day. While my experience with Stripe for my SaaS product has been great I don't like that they hold on to funds for ten days. Square transfers the money the same or the next day.

[no_wizard]

Adyen can be used beyond the EU[0] and they’re quite reasonable as well. Covers the majority of commerce areas globally

[0]: https://www.adyen.com/knowledge-hub#pago_local

[intrasight]

I've been using Authorize.net for years. Can't imaging using some service that can hold my money hostage. While Authorize.net is "old-school", it is flexible and you are in control. Remind me again why people use Stripe?

[stijnveken]

The is also Mollie [0] if you're in Europe. It's more comparable to Stripe than Adyen if you're just accepting payments in my experience.

[0] https://mollie.com

[Semaphor]

> Obviously Adyen if you're in EU

Though they have "call us" so I’m thinking it’s only for big businesses.

> one do payments in the 10-100$ USD range on the blockchain

Yes, depending on the chain that results in expensive fees, and then there’s the whole wait for validations which makes it not so instant.

> What if you don't want to go through an exchange?

If you want to convert it to a proper currency, you’ll either have to do that, or something like localbitcoin.

[bornfreddy]

> (can one do payments in the 10-100$ USD range on the blockchain? What if you don't want to go through an exchange?)

Yes, there are quite a few of them. For smaller sums KYC is usually not needed. No exchange needed either - as a customer you just send crypto to the payment address they give you, and as a merchant you receive your funds (minus some fee) in either fiat or crypto. No exchange needed in either case. As a merchant you obviously need to do KYC regardless of the amount received.

I know of Bitpay and ForumPay, but there are others too.

EDIT: depending on the currency the blockchain fees can be very low (or very high), so it pays to do your homework.

[tpxl]

> What if you don't want to go through an exchange?

You don't need an exchange to take payments, but you will need to trade the currency into fiat at one point, either through an exchange or an OTC trade.

[yamtaddle]

There are alternatives, but you will find support horror stories about all of them. Unless they're very new, maybe. Certainly PayPal/Braintree is no refuge from this sort of madness.

[johneth]

> Are there any real alternatives to Stripe?

Paddle.

More expensive than some, but they become the Merchant of Record and handle sales taxes / VAT / GST / etc. in many countries for you.

[flopriore]

Revolut

[thdc]

I find it saddening how many tales of customer support not being able to resolve issues hit the internet, followed by the issue being resolved by going through other avenues or after "threats" of bad publicity or not being resolved at all.

I wonder if the possible future demise of Twitter will, in some ways, exacerbate this issue as Twitter is (one of) the largest public speaking squares where you can hold companies accountable for this kind of problem.

[fortituded0002]

> I told the contacts at Stripe that I would do a write up about what happened from my point of view to help them understand what happened to me. I figured it would be good to do that write up publicly to help both Stripe and potential Stripe customers understand what happened and how it was resolved.

Sucks that you had to get to this point, but thank you for taking the time to do this and being rational about it. Being able to review what went sideways is invaluable for big companies and complex processes on their end. Having customer input can really help push things in the right direction for everyone (including existing and future customers).

(FYI: not affiliated with Stripe. Just glad to see people pushing things forward in a way that is not only productive but can have positive impact on people.)

[puntofisso]

What scares me is that there's very little in terms of user rights, and where entire businesses depend on it, things might get very bad very quickly.

It's not just Stripe by the way: I had my own issue with PayPal (luckily, not very serious as I only had $8 in the account): https://puntofisso.medium.com/paypal-closed-my-account-with-.... And, famously here in the UK, Richard Davey had the same with a high street bank, HSBC: https://medium.com/@photonstorm/hsbc-is-killing-my-business-....

Most of these incidents are caused by entirely misplaced anti-fraud regulation, which is based on assumptions that come from a different era in which transaction were mostly national, mostly predictable, mostly referring to a set of easy-to-understand products and services.

I wonder if what we need is to advocate for new policies and regulations with our respective national legislators.

[zackmorris]

I wish there was an online proxy service that acted as a mediator between consumers and vendors. Instead of signing up with Stripe, PayPal, Google, etc directly, we'd sign up with the proxy and pay a small fee (maybe 1/4%) to handle any disputes. That way if/when grievances get ignored, the proxy could do things like withhold payment from the other customers until the situation gets resolved.

Ideally, no payment would ever get withheld. The proxy would maintain its own support database and build workflows for the most common disputes. So something like this situation would no longer happen, because they'd have the solution on file from any previous customers who went through it. Kind of like Stack Overflow for disputes, except internal so that customers don't have to deal with it. Vendors could even get access to the database to have better internal controls and avoid the snafus that lead to bad press like this.

Otherwise I just worry that every insanely great web company will inevitably turn into the next monopoly and we'll never get free of resorting to HN and lawyers.

[jpmattia]

Let's face it: Customer support is viewed as a cost center.

Until there is some negative financial consequence associated with inadequate customer support, there will be no improvement, so plan accordingly.

[fnordpiglet]

I would note that in a fraud investigation or other sorts of investigations of malfeasance in financial crimes a lack of communication is a key component. Communications provide information to the fraudster about which they can plan around the investigation or deceive it. It also provides a direct vector for social engineering. I’m not saying it’s all good or any commentary on the stripe issue, but from my work in this space it’s sometimes not about customer service but about investigating a possible financial crime - which financial services companies are on the hook for. It’s not the police’s job to KYC, AML, or other investigations - it’s the companies job, and if they do a bad job of it or do it in a way a regulator finds easily compromised, they are the ones liable.

[ryandrake]

I guess the question I'm left with is: Are you going to continue using Stripe? Because if so, then it looks like nobody learned anything and the business has little reason to change, having not even lost the unfairly-treated customer over it.

[sovietmudkipz]

Emotionally speaking (and assuming $400k is a significantly higher sales target than normal), what was it like to see the business success before you realized there was a lock on your accounts? What was it like after realizing the locks?

[honoraryfly]

Did they give any explanation of exactly why they had temporarily stolen your $400,000?

That's what would worry me the most after it's been resolved, just how arbitrary and opaque and uncommunicative their whole process is.

I wonder how many other people they've screwed over with this terrible approach to customer service. We'll probably never know, it's not something they're likely to be transparent about.

I'm very glad you went public with this to show the unapologetically uncooperative underbelly of such a well-marketed darling of the payment services space.

[auggierose]

It seems to me Stripe et al. use social media as a filter: If somebody posts their complaints here in the open, it is much more likely not to be their fault / due to shady stuff, but instead probably Stripe's fault. If instead you contact them through normal channels, then they don't have this filter, and will need to spend much more resources on cases where Stripe got it right in the first place.

I don't like it, but until there is a law against it or customers vote with their feet, seems to be a valid business strategy.

[ivanstojic]

Seeing stories like this makes me very averse to the idea of running a business myself.

I don’t mind the idea of trying and failing because the market isn’t there or my execution sucks, but trying and having my earnings be trapped in an algorithmic black hole with no customer support - no thank you. I don’t think there’s any other kind of business interaction that works in this way.

Eg, I can’t imagine one day waking up to my electric company unplugging my house and refusing to talk to me ever again.

[lol768]

> But, there is a balance between automation and manual review. When someone like me gets caught up in an automated system there needs to be better ways of letting support help that person.

This keeps happening, again and again. It's not just Stripe, Google is a huge offender when it comes to automated decision-making and next-to-no human support when it inevitably goes wrong.

GDPR explicitly requires that companies provide a right to human intervention to data subjects, and this is the sort of regulation that needs adopting in other jurisdictions:

> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

> In the cases referred to in points (a) and (c) of paragraph 2 [explicit consent given/necessary for contract], the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

[miohtama]

In the case of finance, anti-money laundering laws triump GDPR.

If you as a financial institution suspect money laundering by your client i.e. a spike in transaction volume, you as a financial institution have an unlimited time to not to reply, can freeze the assets and cannot be held responsible for any inconvenience. Even suspecting money laundering is enough, you do not need to have an evidence. In fact it is opposite and it is a criminal offensive to tip off anyone about AML issues. The law is very one sided.

https://www.mondaq.com/cyprus/privacy-protection/1008074/gdp...

[soco]

I imagine once you're locked out of the account whatever that is, relying on GDPR will mean getting a lawyer and all that - by no means a quick or cheap way to sort out your problem. GDPR will only be helpful after applying enough fines and lost processes, finally forcing Google/Stripe/etc to rethink their support strategy. Which means continuous hassle for today's customers and blaming GDPR for being "toothless" (blame set usually by the same people which claim the invisible hand would sort it out automagically).

[mytailorisrich]

Of course none of that applies if the Stripe account belongs to a business as opposed to an individual.