Thread by @rameerez

A few entrepreneur friends seem to also be having this problem so I'm sharing this:

For the past few weeks, we've been targeted with a credit card testing fraud attack on Stripe.

Literally thousands of blocked charges, hundreds in fraudulent payments, ~$2M in blocked charges

All similar to what @levelsio @dannypostmaa @kevntz etc already described:

- fraudulent payments using stolen US credit cards
- using PH billing addresses
- with VPNs to sign up & make the payment from BD LA SG etc

A % of these fake charges go through and end up in disputes

@levelsio @dannypostmaa @kevntz All fraudulent payments look the same: lots of credit card tries until one succeeds

@levelsio @dannypostmaa @kevntz On some of these fraudulent charges, Stripe Radar reports high number of cards associated with the same IP addr

@levelsio @dannypostmaa @kevntz Got most of the fraudulent payments ~ mid May

One morning I woke up to literally dozens of fake charges

Had to refund + block all of them manually. If you don't, they become disputes in a few days and your Stripe account is at risk of getting banned due to high % of disputes

@levelsio @dannypostmaa @kevntz Got most of the recent fraudulent charges under the infamous name "jake smith"

But also some other PH names like "amber rodriquez"

Most lowercase, most with PH billing addresses

Turned on Stripe Radar and started configuring rules and blocking pretty aggressively

I'm now blocking *all* payments from 7 countries, all of which had associated fraudulent payments (YE, VN, LA, KH, BD, SG, PH)

+ added custom block / review rules like this

Can't believe Stripe doesn't automatically block payments as obviously fake as these @patrickc

Lots of entrepreneurs are losing lots of time + money (fees, disputes) + putting our Stripe accounts at risk because of this particular credit card testing fraud attack

@patrickc I see some speculating this has to do with affiliate scams (@getRewardful etc)

IMHO this is NOT the case.

I don't have a single affiliate link and I've gotten the same attack on different Stripe accounts.

This is just plain credit card testing stripe.com/docs/disputes/…

@patrickc @getRewardful This is my current theory:

Imagine you purchase a big DB of stolen US credit cards

You wanna commit big time fraud with them (i.e.: charge them thousands of $)

But you don't know which ones work and which ones don't.

And you can't risk getting blocked from big websites.

@patrickc @getRewardful So you find small online businesses where you can test CCs with cheap purchases $9, $29, etc.

These are your "burner" businesses

Purchases under $100 usually are not suspicious right? Easy for small companies to overlook

@patrickc @getRewardful Then, when one CC works you just use it purchase thousands of dollars worth of gift cards or whatever

You resell them at a discount in shady forums, pocket the profits, rinse and repeat

This is the typical Indian call center scam, with a twist

@patrickc @getRewardful Small business like me block you, but you were never going to purchase anything from us anyways

You're still good with Amazon, Google, Apple, Steam, etc. where you want to do the actual purchases

You only do the real purchase there when you're 100% sure it's going to go thru

I'm getting a few weird replies, so I thought I'd clarify this: I LOVE Stripe, and the more I use it, the more I understand and appreciate its value. It's an extremely well-built product and me and all my entrepreneur friends use it and promote it whenever we get the chance.

But this is a very real problem I've been struggling with for the past ~month, and I'm shocked because I would have assumed Stripe handled these kind of things on its own without costing me and my company money and trouble.

I have empathy for Stripe, running companies is hard

But this issue has become a daily problem for me and many fellow entrepreneurs

Every day I wake up to a few fraudulent charges and I need to spend time and energy reviewing + refunding/blocking payments

Very time consuming

+ happening at a large scale

= needs fixing ASAP

Update: Stripe is already tackling this

24h update: Stripe seems to be investigating but is not being able to stop the attack

Many founders, me included, are still reporting credit card testing fraud

It looks like this has been going on for ~2 months news.ycombinator.com/item?id=361970…

$ millions lost in fraud charges likely

Best course of action for founders right now seems to be to block aggressively + set up custom Radar rules

Some I already described in the thread, some others:

https://twitter.com/jijosunny/status/1665701071417757696

Meanwhile Stripe algorithm still thinking we're overreacting