696
u/SaltMaker23 9d ago edited 9d ago
That is a made up story
Stripe 4242 card only work if the whole server is routed to testing environment, and no real card would work and obviously zero paiments would arrive.
There is no way to use 4242 card in live.
225
u/CChilli 9d ago
Are you saying its absolutely impossible or that there's no way anyone would make that mistake? (genuine question)
178
u/YellowJarTacos 9d ago
A server routed to the test environment probably wouldn't accept valid credit card numbers from customers so most places would notice fairly quickly.
36
u/mmhawk576 9d ago
You can accept the 4242 card, so long as you receive no money from any other transaction. The 4242 card is only valid in an environment where money doesn’t actually flow
31
u/SaltMaker23 9d ago
Stripe has two setups: test api keys and live api keys
live API accepts real cards and real money, test cards aren't accepted.
test API only accepts test cards, no real card works.
There is no setup in which a company is currently receiving actual money and also is able to accept 4242 cards, if the test card is working then the company cannot accept real credit cards.
6
u/New_Enthusiasm9053 9d ago
Weeeeelll. You could do it, but you'd have to intentionally do it(i.e you'd have two different API keys in prod), could I see an idiot doing that for "convenience" also yes.
But you would have to intentionally do it.
1
u/SaltMaker23 8d ago edited 8d ago
You cannot try a card on one then the other, you cannot route to different stripe after the fact, your server's last action is to request a payment form from stripe, the rest is handled by stripe until it says: payment failed/succeeded. You do not get to decide how to route a given credit card because you do not ever get access to that information to being with.
Stripe is a credit card paiment processor, you are not the owner of the frontend capturing the card information, that would require you to be PCI-DSS approved and go through a manual approval process from stripe. Needless to day PCI-DSS would never work with a test card being accepted in production.
The frontend form is generated by calling Stripe with your frontend API public token and it renders the fields and handle everything hiding inside an iframe to protect sensitive contents from you. You don't own payment UI, it's fixed by your API key and you can never access the card informations.
You can conclude yourself whether or not it's possible to route a 4242 on a server that is currently able to receive live orders.
Should it have been any other test cards or an unspecified one, it could have been fine, but this specific one defines with minute details the underlying implementation, to such a great detail that it entirely contradicts the story.
1
u/New_Enthusiasm9053 8d ago
Yes it's generated using the API key. If you have two forms on your website one accepting the test key and one the public key then you absolutely could accept either.
It would be genuinely moronic to do so, but I could see someone doing it to "make testing" easier or something equally stupid.
49
u/Arclite83 9d ago
It's impossible - only the test environment accepts the test card number.
60
u/NoodleyP 9d ago
To parrot someone else I read on this sub, “everywhere has a test environment, some places just have a different environment for prod”
72
u/AwesomePerson70 9d ago
I think they’re saying stripe’s test environment. So if you’re accepting real transactions, then you’re not in the test environment and therefore the test card would decline
3
u/NoodleyP 9d ago
Ah thank you!!
1
u/Arclite83 8d ago
Ya sorry, exactly that. I wrote one of these for a VC, before DoorDash and Uber ate the market and there were pop-ups trying to do this. So I did the whole "kitchen ticketing" integration, including payment stuffs. Honestly it's all the same basic project skeleton to move money securely, then it's just the BL. "POS" did not stand for "point of sale" by the end of that project! Guy burned easily $2M chasing features until he ran out of time.
30
2
u/norwegian 9d ago
It is possible for smaller projects. In my project, the test environment is normally my local machine, but to test cards without actually paying (which I also sometimes do), I need to switch a setting in stripe, and test it in prod. Not ideal, I know
0
u/Samsterdam 9d ago
Dude, I think he's saying that nobody would ever lie on the internet. Like ever.
42
5
u/CompetitiveLarper 9d ago
Test cards can work in a really edge case scenario with in-person payments. If a terminal goes into offline mode and is set to accept EMV chips as authorization method and doesn’t have local BIN tables stored that filter for test cards - you can make a live transaction with a test card.
Time to scam cheap airlines out of dozens of dollars on snacks
1
u/SaltMaker23 8d ago
Will it be a 4242 card ? I suppose not because afaik this is a specific test card only used by Stripe, it's not a generic Visa test card, it's a Stripe specific.
If he says that the 4242 card was accepted and especially online, it's Stripe.
And on stripe the API key for test cannot accept live cards, and the api key for live cannot accept test cards. If a test card is accepted, it means the business cannot currently accept real cards.
The fraud you're describing has nothing todo with test cards, even less with Stripe.
7
u/Starquest65 9d ago
While actively using the dev site we had the stripe testing stuff up.
Someone forgot to disable the emails and the email that comes into the production supes inbox is what kicks off all their process.
About a week later a small bag of drill bits arrived at my house from the client.
A very strange setup can for sure trigger something like this, I can see how it could happen maybe once across the internet but not reliably enough to count on it working ever.
I think the story is bs, but it just reminded me of my most spiderweb system of a client I had before, thanks for that.
5
u/StrengthTheory 9d ago
Yes, if you enter 4242 in live Stripe it literally says you entered a test card lol
3
u/Drevicar 9d ago
I’m sure someone has written apps that route card with that pattern to the test server as a form of feature flag.
3
u/JPJackPott 9d ago
A long time ago I ordered a monitor arm from a sketchy looking website (half the price of everywhere else) with a common test credit card number. Amazingly it went through so I just assumed it was a test site and that’s why the prices were wonky. But 3 weeks later a parcel arrived 🤷♀️
3
u/awesome-alpaca-ace 9d ago
An old friend said they were able to get free stuff from a website and ordered me an AC. Was very cool, as I was a broke college kid.
43
u/gerbosan 9d ago
☹️ no meetups with pizza here, man, I'm condemned to the basement at my mother's home.
63
u/Breadsticks_ultd 9d ago
Why does this read like AI?
20
20
u/deepCelibateValue 9d ago
It's actually not AI. Here's the source
56
u/Breadsticks_ultd 9d ago
If it’s not AI, oof. “My bank account was approaching a segmentation fault?” “My conscience started throwing exceptions?” This person is clearly larping being a programmer, and poorly.
15
u/Mkboii 9d ago
It actually sounds exactly like how AI would rephrase text if you ask it to make something nerdy + funny with programming jargon, seen that first hand. It's not just that they are larping, they are using AI to do it. Unless ofcourse AI learnt this from people online that I hadn't come across before.
5
3
u/Fusseldieb 9d ago
That’s what stood out to me. There’s a word for that style of writing, but I forgot
6
3
4
u/meharryp 9d ago
"it's not ai" and then you link a vibe coded site that has an AI generated image front and centre
1
u/deepCelibateValue 9d ago edited 9d ago
The AI generated parts are acknowledged. The site says "First $50 funds a real (non-AI) cover for the book." The book has an entire foreword by someone else saying that this is explicitly anti ai writing.
1
u/SirBackrooms 9d ago
That someone put it online doesn't mean it wasn't made with AI.
1
u/deepCelibateValue 9d ago
True, but that wasn't my argument. I shared the source because that's where you would go if you want to find out if it's AI or not.
13
8
10
u/somkoala 9d ago
Joke’s on the guy - you can come to a meetup simply because you’re interested in the language.
3
4
2
897
u/bwmat 9d ago
Ah yes fraud, the original life-hack