jarrett | Stripe Developers | Page 1

quasi canyonBOT Dec 27, 2022, 3:32 PM

#

last wharf Dec 27, 2022, 3:41 PM

#

HI there 👋 liability shift topics are more policy related questions, and as far as I understand those policies are mostly set by parties other than Stripe. So I'm not sure how much insight I'll be able to offer, but will see what I can find.

#

There are a couple resources that I've found so far.

First is that when using request_three_d_secure, it is expected for 3DS to not be required if the 3DS is not available for the card:
https://stripe.com/docs/payments/3d-secure#manual-three-ds:~:text=If it’s not available for the given card%2C the payment proceeds normally.

#

It also looks like liability shift is pretty limited for Apple Pay, with its availability being dependent on both card network and location.
https://support.stripe.com/questions/liability-shift-for-apple-pay-charges

Liability shift for Apple Pay charges : Stripe: Help & Support

Find help and support for Stripe. Our support center provides answers on all types of situations, including account information, charges and refunds, and subscriptions information. Get your questions answered and find international support for Stripe.

cobalt junco Dec 27, 2022, 4:00 PM

#

I don't understand how it's fair for the bank or card provider to determine if they want to do 3DS and then put the liability back on me, the merchant, when I didn't authorize that. I specifically requested that level of authentication.

#

It's totally absurd for the bank to chose a riskier option and then pass that liability back to me. It's a total conflict of interest since they make money on the transaction fee regardless of if it's fraud.

#

It's also totally screwed up that on top of the lost revenue I will be forced to absorb, I have to pay the fees associated with collecting that revenue.

last wharf Dec 27, 2022, 4:12 PM

#

My understanding is that liability shift only occurs when an authentication challenge is completed, not just because you asked for 3DS. So it seems to me less that liability was shifted back to you more, and more like that the initial liability shift never occurred.

I believe liability shift only occurs when there is a strong belief that the authentication challenge confirms validity (OTA code or frictionless for 3DS, biometric for Apple Pay).

#

Looking at the rules reference for Radar for Fraud Teams, it looks like there is the ability to hook onto whether liability shift occurred for a payment and add allow/block rules around that.
https://stripe.com/docs/radar/rules/reference#:~:text=Primary Account Number.-,has_liability_shift,-Boolean

Rules reference

Learn more about the structure of rules and the order in which Radar processes them.

cobalt junco Dec 27, 2022, 4:16 PM

#

Honestly, Stripes fraud detection is just not good. All of the fraud that we ever have is always coming through as Normal risk. We've never accepted a "high" risk payment and it's really frustrating that we have everything dialed up to the max (which hurts our conversions) but is required to prevent fraud. And then when fraud does happen we're on the hook and the bank makes money.

ivory dust Dec 27, 2022, 4:50 PM

#

👋 stepping in as toby needs to step away

#jarrett