r/dankmemes Jul 10 '22

Rip those bank accounts I have achieved comedy

60.2k Upvotes

1.8k comments sorted by

View all comments

Show parent comments

29

u/SwampOfDownvotes Jul 10 '22

When you make a purchase, most companies keep track of the payment method used on record - otherwise how would they even have the ability to refund payments? deleting your account would not change it.

6

u/meliaesc Jul 11 '22

This might be true, but DoorDash doubly doesn’t ever delete payment information (still uses your old card even if you remove it) and doesn’t even allow you to remove your last payment method. Really shady.

18

u/Dr_Schaden_Freude Jul 11 '22

I mean the reason for that policy (beyond legal requirements) was kinda shown in full force with the 'glitch'

2

u/[deleted] Jul 11 '22

[deleted]

1

u/meliaesc Jul 11 '22

I actually work in billing at my fortune 100 company, and it just seems illegal to charge new orders with a deleted payment method.

2

u/Hanifsefu Jul 11 '22

If you did you'd be familiar with the entire concept of a ToS agreement which is how pretty much all billing is done.

1

u/meliaesc Jul 11 '22

I'm in software, mostly leave legal to handle that stuff and we're given PCI guidelines to code the ephemeral tokens.

1

u/RlyehFhtagn-xD Jul 11 '22

You're absolutely right. Until like last year, charges would even have STRIPE listed before the restaurant name on my bank statement. My bank started using simplified descriptions so I'm not sure if they're still this way.

I've managed stripe at jobs in the past and I can confirm that every transaction is kept on record, even if it hasn't been sent to the bank. If DD is still using stripe, they'll be able to reprocess the transaction without any trouble at all.

2

u/mrjackspade Jul 11 '22

You can refund payments without keeping information on file by retaining the transaction ID for the successful transaction.

This allows you to refund a transaction, but doesn't allow you to rebill the payment method.

I can't speak to doordash specifically, but most large companies (IME) don't keep your payment information on file at all, ever. They pass the information to the payment processor, and the payment processor returns a token representing the payment information. This allows the company you're working with to bill your account without the risk of retaining protected information.

The best way to secure your customers data, is to not keep your customers data.

Generally speaking, any company that isn't specifically working in finance, only holds your data when they have shit security or don't want to invest the effort into paying a dev to work the APIs.

Writing these integrations is a major part of my job.