A post we hadn’t wanted to write, after all the time put into building the Golgotha Graphics FastSpring store, but it’s time for it to be written.
In the middle of May 2026, we received an email from FastSpring, notifying us that our normally sedate little store had a payout coming up. Intrigued, we logged in to see what had been happening. We discovered that for the past three months, there had been dozens of transaction attempts per minute on the Golgotha Graphics FastSpring store; day in, day out, twenty-four hours a day. While most of these transactions failed, a sufficient quantity made it through, to result in there being enough money in our FastSpring balance to trigger a payout.
These transactions were confined to the United States of America, the names were often popculture references and repeated in multiple purchases, the addresses likewise. Many of them were from people who lived at 742 Evergreen Terrace – The Simpsons home address.
Immediately upon reading this data, we contacted FastSpring to inform them about what was happening, and relay our concerns that although we didn’t know what for sure, something looked very wrong.
It turns out that what had been happening (as best as we can gather), is that a system, either bots or people, was using our store’s great value and low prices to test if card numbers would pass. Then, if a transaction was successful, that card and details would presumably be flagged for more significant fraudulent purchases.
FastSpring’s representatives confirmed our suspicion that this was likely, told us they would take care of things, and thanked us for reporting the fraud. Interestingly, they used a phrase that we had been victims of fraud. That will be important later.
So, FastSpring began refunding transactions, and the fraudulent purchase attempts ceased a couple of days later. We were obviously concerned about whether the payout due to us was the proceeds of crime, so we left it sitting in our FastSpring account, and then watched the size of the next scheduled payout shrink, go negative, then go a long way negative.
In fact it went so far negative, that it was eventually greater than the sum total of all the money FastSpring had ever offered to us in payouts. In other words, we now owed FastSpring more money than we had ever “made” over the course of both our legitimate sales, and these months of fraud.
How could this be? Months of emails back and forth, which followed a similar pattern each time; a new representative would receive the case, own it for a couple of messages, then either say they had to pass it on to someone higher up, or just stop replying altogether.
We’d open a new case, be castigated for not continuing the previous one, make clear our displeasure that the previous case had been ignored and opening a new one was the only way to elicit a response, and the cycle would repeat itself.
Meanwhile, the negative balance continued to grow.
Eventually, one of our emails was sufficiently curt, and by stating that we believed FastSpring was engaged in fraud against us, was passed on to someone who had enough authority (or at least the inclination) to provide some answers to our questions about what was going on.
It turns out that when FastSpring receives a chargeback from a credit card company, they pass that chargeback fee on to the store holder, in the form of a US$30 negative balance on their store. The store holder then has to make up for that in sales, or if they choose to close their store with a negative balance, FastSpring will demand the storeholder pay out that negative balance.
It took four months to get that answer.
To dissect why this answer is so wrong, we need to look at what FastSpring’s role is in a FastSpring store. FastSpring is the Merchant of Record for all stores hosted on their system. When a customer buys something from a store, FastSpring appears on their statement as the vendor. FastSpring charges their customers (the store holders) a fee for every sale. Those fees are for transaction processing, and importantly, a part of that transaction processing is the service of providing security for transactions.
Fraud detection and prevention is a service you pay FastSpring to provide, when FastSpring handles the merchant services for a transaction on your FastSpring store.
However, according to FastSpring, when their fraud detection and prevention system fails, and they (as the sole arbiter of whether a transaction goes through) allow a fraudulent transaction to be processed, the financial penalty for their action is levied upon the store holder who paid them a fee for the service of preventing fraudulent transactions.
And that is why our account was further into the negative than the sum total of all the income we had received; FastSpring’s assertion was that because the fraud detection and prevention service we had paid them to provide didn’t work, we should be responsible for recompensing FastSpring for costs they incurred as a result of their ineffective fraud detection and prevention system.
Our position is that FastSpring charged us for fraud detection and prevention services. We paid the fees for those services, and if they don’t work, that is FastSpring’s problem, and FastSpring’s financial responsibility.
Further, FastSpring is the Merchant of Record for every transaction in their system. The transaction is between the credit card user, and FastSpring as the merchant. While it is our product in the store, we do not provide the actual sales service, FastSpring does. Their branding is all over the store experience, and their name is on the transaction. If a stolen card is being used, that is between FastSpring, and the card holder.
This is what we communicated to FastSpring in the middle of September 2026. We heard nothing back. Then, at the beginning of November 2026, we received an email telling us our store had been closed. We immediately responded, asking what was going on, and why the particular person who we had been speaking to in September had failed to respond to our last email.
That resulted in a response from said person, who stated our account was closed due to the negative balance, and inactivity, and enquiring as to whether we would like to discuss a “path to reactivation”.
We said we would like them to respond to our email from mid-September, and restated our position as to what we believed FastSpring should do, and why.
We have now been promised a reply to the original mid-September email, slated to occur “shortly”.