From the moment I began my freelance web design business back in 2014, I was collecting payments via Stripe and happily paying their processing fees for the ability to grow my business from just a desire for more freedom to running a company that employs women and supports them to create their own freedom and financial independence.
It never occurred to me that using Stripe to process payments would become one of the biggest risks to my small business.
My Stripe account was hacked due to Stripe’s lax security, over $70,000 of fraudulent charges were processed by the hacker through a fake connected account, paid out instantly to that person via Stripe’s Instant Payments to the hacker’s pre-paid debit card, and Stripe started pulling the money out of my business bank account to pay back the victims of the theft.
And Stripe says it’s my fault that my account was hacked and that I’m liable to pay back the victims of the fraud.
Listen to the full podcast episode or read on to find out exactly what happened and how to protect your business.
On a quiet Monday morning after the Easter holiday, I was sipping coffee on my couch in Columbus, Ohio like I normally do, snuggling with my dog and going through my normal morning entrepreneurial routine of checking emails and DMs on my business account when I see an email from Stripe with the subject line:
“Subject: [Action required] Closure of your Stripe account”
…
Right, that was my point: Woocommerce doesn’t want to tell people how to do it (even if the code itself would work with one) because then when it doesn’t work they’ll come to them and have to deal with the support.
And the fact it’s dozens of resource types kinda re-states my commentary that it’s not actually as easy or simple as Stripe makes it in the marketing, and Stripe also doesn’t bother to explain to anyone how to safely use the API with restricted keys either; Stripe could just as easily write the documentation for Woocommerce given it’s probably a fairly sizable portion of their small business self hosted customer base.
It’s not all that shocking because rather a lot of software vendors behave in the same way.