Soixante circuits retweetledi
I need to talk about this publicly in order to spread awareness and maybe get advices.
I have $171.000 of stolen credit card money on my Stripe account, I don't want it, I want to give it back and @stripe is making it difficult.
👇 full story bellow
On the 10th of December evening, a wave of fraudulent payments started on Three.js Journey.
Thousands of cards were being used to buy Three.js Journey. Fortunately, I was checking the activity and immediately saw that something was wrong.
While most were blocked by Stripe, 1800 of them went through corresponding to 171.000 stolen USD.
I found a feature called "Radar" on Stripe that lets me choose how reliable the card must be for the payment to go through. First surprise, it's not a built-in feature and I need to pay for it. Fortunately, there is a 30 day trial. I activate it, set the security at the maximum and almost none of the stolen cards payments went through after that.
I immediately contacted Stripe. The person on the phone told me they are going to escalate the ticket to a specialized team and to refund all the 1800 fraudulent payments manually.
I asked if there was an easier way to refund all those payments and the person asked me to send a file listing all the payment IDs so that they would do it. I generated and sent the file in less than 30min.
Later I received an email telling me that what was happening is that the hackers are doing "card testing", meaning that they don't care for the product, they just test cards from various locations in order to test them. Stripe asked me to try to mitigate this which I did by adding some more security features on Three.js Journey in addition to Radar.
Those measures seem to have solved the card testing issue.
Days went by and I started to receive complaints from card owners asking me why they paid for this product that they don't even know.
After a few days, I started to receive disputes from the banks directly and the amount of disputes is getting worse every single day.
I contacted Stripe through chat and by phone multiple times and it's always the same answer:
- Don't do anything regarding those payments
- Do not refund them
- The team is working on it
- We received the payments list that needs to be refunded
- You'll get an answer when we have an update
And it has been like this for 8 days.
This situation is stressing me out so much.
Having this stolen money on my Stripe account, all the fees linked to the payments (because yes I paid for each payment that went through) and the fees linked to the disputes is driving me crazy. We are talking about thousands of USD of fees.
All I want is to make things right, have the card owners refunded and sleep at night without being worried.
I've always liked @stripe. The implementation, the API, the dashboard, the documentation, etc. it's really good. But not knowing what's going on is really hard.
Does anyone have experience with this kind of situation?
I could use some advice.
English
