如何避免Stripe批准后出现逆向付款

Question

批准后条纹批量付款

我在我的网络应用程序中使用 stripe 处理付款 并使用雷达阻止不正确的数据，例如不正确的邮政编码或 CVC

流程如下：

1. 用户向我们提供信用卡详细信息，我们在前端使用此数据创建一个卡令牌。
2. 我们使用客户电子邮件和用户 ID 创建一个 Stripe 客户。
3. 我们使用客户和令牌创建一个条带卡（card_xxx）。该卡可以被用户多次使用。

我们希望如果 CVC 不正确或邮政编码不正确，雷达应返回错误并且不应创建卡

4. 我们使用该卡作为创建费用 (ch_xxx) 的来源，并将

   capture

   字段设置为

   true

我们还希望，如果 CVC 不正确或邮政编码不正确，雷达应返回错误并且不应创建费用

这就是我们在代码中创建收费对象的方式

func (a *stripePaymentHandler) CardCharge(ctx context.Context, stripeCardID model.StripeCardID, customerID model.CustomerID, amount *money.Money, description string) (model.PaymentReference, *stripe.Charge, error) {
    chargeParams := &stripe.ChargeParams{
        Params: stripe.Params{
            Context: ctx,
        },
        Amount:      stripe.Int64(amount.Amount()),
        Currency:    stripe.String(amount.Currency().Code),
        Capture:     stripe.Bool(true),
        Customer:    stripe.String(string(customerID)),
        Description: stripe.String(description),
    }
    chargeParams.SetSource(string(stripeCardID))


    charge, err := a.api.Charges.New(chargeParams)
    if err != nil {
        return "", nil, err
    }
    return model.PaymentReference(charge.ID), charge, nil
}

发生以下两种情况：

😃 邮政编码错误的快乐场景

在步骤 3 中，如果用户输入无效的邮政编码，则用户无法继续创建卡，也无法继续付款流程。

😭 邮政编码错误的悲伤场景

在步骤 3 中，即使用户输入无效的邮政编码，用户也可以继续付款流程 创建 (card_xxx) 对象，然后客户继续执行步骤 4，金额获得授权，但条纹雷达阻止付款，金额会保留几天。

问题是客户抱怨即使交易失败，金额仍被扣留

来自 stripe 文档在这里 👈

When Stripe blocks a payment, it obtains initial authorization from the card issuer but refrains from charging the card. This precaution helps prevent potential fraudulent payments that might lead to disputes.

For some card types, customers might see the card issuer’s authorization for the payment amount on their statement. However, Stripe hasn’t charged this amount or withdrawn funds. The card issuer typically removes this authorization from the customer’s statement within a few days.

这是带有

charge

字段的

outcome

对象示例

{
  "id": "ch_xxxxxxxxxx",
  "object": "charge",
  "amount": 26825,
  "amount_captured": 0,
  "amount_refunded": 0,
  "currency": "usd",
  "customer": "cus_xxxxxxx",
  "outcome": {
    "network_advice_code": null,
    "network_decline_code": null,
    "network_status": "reversed_after_approval",
    "reason": "requested_block_on_incorrect_zip",
    "rule": "block_if_wrong_zip",
    "seller_message": "You requested that Stripe block payments (like this one) for which the customer-entered zip/postal code does not match the code on file with the card-issuing bank.",
    "type": "blocked"
  },
  "paid": false,
  "payment_intent": null,
  "payment_method": "card_xxxxxxxxxx",
  "payment_method_details": {
    "card": {
      "amount_authorized": 26825,
      "authorization_code": "749118",
      "brand": "mastercard",
      "checks": {
        "address_line1_check": null,
        "address_postal_code_check": "fail",
        "cvc_check": "pass"
      },
      "country": "US",
      "exp_month": 12,
      "exp_year": 2028,
      "extended_authorization": {
        "status": "disabled"
      },
      "fingerprint": "xxxxxxxxx",
      "funding": "debit",
      "incremental_authorization": {
        "status": "unavailable"
      },
      "installments": null,
      "last4": "1234",
      "mandate": null,
      "multicapture": {
        "status": "unavailable"
      },
      "network": "mastercard",
      "network_token": {
        "used": false
      },
      "overcapture": {
        "maximum_amount_capturable": 26825,
        "status": "unavailable"
      },
      "three_d_secure": null,
      "wallet": null
    },
    "type": "card"
  },
  "refunded": false,
  "refunds": {
    "object": "list",
    "data": [],
    "has_more": false,
    "total_count": 0,
    "url": "/v1/charges/ch_xxxxxxxx/refunds"
  },
  "source": {
    "id": "card_xxxxxxxxxx",
    "object": "card",
    "address_zip": "XXXXX",
    "address_zip_check": "fail",
    "brand": "MasterCard",
    "country": "US",
    "customer": "cus_xxxxxxxx",
    "cvc_check": "pass",
    "dynamic_last4": null,
    "exp_month": 12,
    "exp_year": 2028,
    "fingerprint": "xxxxxxxx",
    "funding": "debit",
    "last4": "1234",
    "metadata": {},
    "name": "",
    "tokenization_method": null,
    "wallet": null
  },
  "source_transfer": null,
  "statement_descriptor": null,
  "statement_descriptor_suffix": null,
  "status": "failed",
  "transfer_data": null,
  "transfer_group": null
}

我想问是否有办法避免这种行为 客户可能会在对账单上看到发卡机构对付款金额的授权。

可能有更好的流程或在授权金额之前检查邮政编码的方法或者避免这种情况的最佳做法是什么。

我尝试阅读 stripe 文档，但他们没有告诉我们如何避免这种行为。

Answer 1

这是一个遗留流程。您应该使用 SetupIntent 流程 来验证卡，以便 Stripe 在设置时检查邮政编码。