EU-based Indie Hackers: ⚠️ SCA is 4 days away
https://stripe.com/docs/strong-customer-authentication
I'm beginning implementation on this today so I thought it was worthwhile to post a reminder for other EEA-based startups.
If you're an EEA-based startup and you accept credit card payments (subscription or once-off) then make sure that you support Strong Customer Authentications (SCA) or it's likely that you will see an increase in failed payments from Saturday onwards.
Stripe's docs are here: https://stripe.com/docs/strong-customer-authentication
Braintree is way late with this. I went through about three weeks of back-and-forth with Braintree support where their replies were, well, bizarre: they would speak in generalities, or describe flows which were not relevant to my use case. After three weeks I finally understood that Braintree quite simply isn’t ready for SCA, and all their calls to action and E-mails are pretty much a smoke screen. I got them to eventually confirm this.
The current status quo is that I am waiting for them to get their software ready. Latest changes are landing regularly, so perhaps they will.
Based on what I see, I think this whole SCA thing is going to be a terrible mess. I hope the introduction will get delayed.
Wow, that's poor form from Braintree. In fairness, Stripe have been excellent, they are super prepared.
I don't know if it will be delayed but I imagine it will be a slow roll-out. I would be surprised if all EU banks started immediately issuing 3DS challenges on all eligible transactions.
Stripe released their finished API yesterday, and the documentation has been lagging behind for weeks, particularly for Stripe Connect and the more complicated features. I think no one is really prepared. I’ve been in touch with developers frantically implementing new APIs ever day for the last weeks. Stripes current API version is... yesterday.
I am with a German bank. Even my bank is not prepared. They are even disabling their mobile app as they didn’t get it ready in time. Think about that. Banks removing installed apps and their functionalities from their customers devices. Due to non-compliance.
The whole thing is a debacle, and in 4 days we will have an interesting time :)
Oh wow, I didn't realise that Stripe was lagging behind too. I only started implementing this today and it went pretty smoothly although my app doesn't have any Stripe Connect features. I have had to complicate my business logic a bit though.
Example: My app requires a credit card to start the trial but it doesn't charge payment until the trial ends. Stripe will create a trial subscription even if the 3DS challenge fails, so I needed to handle that new state.
This will also affect you if you are not based in the EU but have European customers. Their banks are bound to decline all charges that are not correctly authenticated. So ALL your European customers, if you have any, will eventually have all their payments fail unless you implement the new versions and requirements of payment processors. Saturday will be quite the day for a lot of businesses. And the payment providers support crew...
My understanding is that it's only a concern for non-EEA businesses if they pay out to an EEA bank account. In other words, only non-EEA businesses that use Stripe Connect (i.e. marketplace businesses) need to take action.
Who knows how this will turn out in practice though. Each bank will probably implement this slightly differently and apply different rules. Banks write buggy code too. It's conceivable that non-EEA businesses will see a spike in payment failures too.
I think most likely the rollout will be super slow but who knows what will happen.
Indeed, let’s see! It would be very good for e-commerce if only European companies were affected. I have the feeling they won’t, so I’ll be following the situation closely.
Everything about this legislation was rushed. Very unusual for Europe.
I'm a bit scared by this, as I've gotten e-mails today that Stripe "saw in my logs that I haven't done the update yet", but the update was done.
Wrote back, and they told me it's probably just a bug or together with the fact that I'm running a Connect platform.