They don’t need to keep anything. The card details will be stored with Stripe, if they don’t actively tell Stripe to delete those details then they’ll be able to create a new subscription and charge the card.
For the vast majority of cases all you need to charge a card is the 16 digit number on the front and an expiry date. Pretty much everything else is optional (CVV, Name, Address etc), but opens you up to stupid levels of liability in the disputes process if you didn’t include it in the original payment request.
Agreed. I’d go as far as to say they were irresponsible to not tell Stripe to delete/deauthorize the tokens.
In fact, why does any customer in their database have ANY connection to Stripe after they’ve canceled? I haven’t used stripe but I’m guessing there’s some sort of customer ID/token. If they’ve canceled why are you retaining that?
So that’s two things. Even if the code encountered a bug like they did here, it shouldn’t of been possible to actually trigger a new subscription.
Stripe offers a billing product that serves as a source of truth for the entire subscription lifecycle. Companies are legally required to maintain financial accounts and nowadays accountants can even do your reporting using the data directly from stripe.
What’s happening here is that there’s a user who has a card on file and a cancelled subscription, and an erroneous new subscription is being created under that user.
Whether or not it makes sense to remove the card from the user account depends on whether or not that user could meaningfully have multiple subscriptions or expect to renew in the medium-term future.
Card issuer risk model heuristics will also apply different amounts of scrutiny based on transaction size and type. You could do a two dollar transaction just with card number, I wouldn't expect a twenty thousand dollar transaction to go through without the other fields.
Joking aside, I don't see how a signature is of any use provides your card is supposed to have yours on the back, so anyone having your card has your signature too. PINs have been a thing since I've had a card (2011), and I don't see why anyone still relies on signatures for card authentication.
The way things work in developed countries is the following - payments under 30,50,100 euros (depending on the country) are contactless where you just tap your card on top and it's done, and for more you have to insert the card and type your PIN. Or you can just use your phone for any amount by tapping it.
It's not a joke, US payment systems are hot garbage (as are bank apps). Much if the rest of the world has been doing contactless payment for 5 years already.
For the vast majority of cases all you need to charge a card is the 16 digit number on the front and an expiry date. Pretty much everything else is optional (CVV, Name, Address etc), but opens you up to stupid levels of liability in the disputes process if you didn’t include it in the original payment request.