Captain McAteer

Final update for this story (I hope). If you are selling something online (not only with Stripe), read the tweet 👇 After 8 days, all payments had been refunded. It took too long, but Stripe assured me that it was unusual and will make sure it doesn't happen again. After 11 days, Stripe calculated all the fees (payment fees, dispute fees, currency conversion between payment and refund) and reimbursed me the FULL AMOUNT! 🎉 Everything is back to normal, thank you @stripe Still, there are a few lessons I've learned and I though I should share those. 1. First, "card testing" is a thing. I discovered that the hard way. Quick summary, it's when people test stolen cards through VPN to test if they work and from what country they will most likely work. In my case, they attempted to purchase for 8.000.000 USD worth in a matter of a few hours, Stripe blocked most of it but 170.000 USD went through. 2. When you create your business and the purchase tunnel, try to figure out if someone with bad intentions can easily use your website to test cards. If so, make it harder. I'm not going to explain in public the various security features I've setup, but if you need, contact me in private. Still, I can tell you one, CAPTCHA. And the CAPTCHA could show up only when there is an unusual amount of payments. 3. If you get card tested, call the payment solution immediately and while you're on hold, try to block the payments, even if it means putting the whole website offline for a few hours. Stripe support answers really fast. It's a matter of minutes before you have someone on the phone. 4. Deactivate the payouts. If the money is wired to your bank account, you won't be able to refund the payments and it's going to get worse. 5. Refund all the payments immediately. If you feel like doing a script, go ahead, but be careful, you are probably not in a state where you can write good code and you might end up making mistakes. I remember needing to be pro-active but totally crushed at the same time. Just go through them manually, even if it takes hours. If you do it fast enough, card owners might not even perceive the payment. If you take too long, it might end up in disputes that will result in more fees. 6. Always keep an eye on your sales. It happened to me on Sunday evening around 9PM and I saw it around 10:30PM. Fortunately, I check multiple times a day, even the weekend, but how many businesses do that? 7. In the case of Stripe, you can't rely on Radar. Radar is a feature that analyse the payments and help you prevent fraudulent payments. Sounds great, but there is a cost for each payment intent. I'm talking about "intent", not actual completed payment. Meaning that if you receive thousands and thousands of payment intents, you are going to be ruined. Yet, there is a 30 days free trial that I immediately activated. It's a good temporary solution, but make sure to deactivate it after before the end of the trial. Final word about Stripe. Although, I find the Radar feature a bit shady, I'm still very happy with Stripe. It's so easy to implement, the interface and the documentation are so clear, they keep on improving the service, it works in most countries around the globe. The problem I had could have happened with other solutions, and maybe it wouldn't have gone this well in the end. Glad it's sorted out. Thank you for all the comments and support I received. Always happy to see there are good people ready to help.

I find this testimony from Harvard, MIT and Penn to be absolutely despicable. First off, let me say what is plain on the surface: The presidents of our universities are moral cowards. Instead of establishing clarity, they beat a retreat into corporate-speak. What I and others are furious about isn’t our colleges’ treatment of speech. Hate speech is constitutionally protected. See: National Socialist Party v. Skokie, when, in 1977, American courts affirmed the right of neo-Nazis to march through the town of Skokie, Illinois. I am proud to live in a country that believes good ideas will prevail over bad as long as they are both permitted. What I AM furious about is the loss of shared human values and common decency. Hiding behind legalese rather than confronting the ugly reality of anti-Jewish terrorism—not hypothetical hate but actual, *realized* murder and rape. What I am furious about is the smugness of getting one over on a technicality rather than the moral seriousness demanded by the occasion. This is what I would have liked to hear: “Any calls to genocide are disgusting and I condemn to the most extreme degree all forms of hate. I personally detest the views expressed on campus, and our university takes the most extreme measures to protect our Jewish students from physical violence, harassment, and threat. But we do not believe it is our role to police speech, even when it is detestable. And it is our policy as a university to allow speech which is explicitly protected by the United States Constitution.” That would be a coup! It would at least enforce a greater symmetry in condemnation between, say, the death of George Floyd, and the gruesome pogroms of October 7th. Instead what we got was an obnoxious unwillingness to take a moral stand when the world most needed and expected it from America’s academic leaders. The financial and reputational punishment doled to these universities will be swift, and I have faith the Ivies and other bastions of academia will find firm moral ground under the sword of donor fury. I look forward to the day when our leaders can once again look the public in the face and defend basic human ideals.

i often think of this reply. It's too bad, really! We need more role models for how to "live pseudonymously." Besides Satoshi, guess we have Carl Sagan and Mr. X? Usually can only appreciate them in hindsight after they're burned