The danger of using "Hide My Email" with third-party Stripe handoffs

4 points

3 months ago

If you use Apple's "Hide My Email" on a platform that hands you off to Stripe (like BuyMeACoffee), you might get permanently locked out of your Stripe account.

Here is how the systems fail when combined:

1. I signed up for BuyMeACoffee using "Sign in with Apple" and chose to hide my email. Apple created a `@privaterelay.appleid.com` address.

2. BuyMeACoffee initiated a Stripe Express onboarding flow and passed that Private Relay email to Stripe as my primary contact.

3. Stripe requires email verification to process payouts, so they sent a verification link.

4. According to Apple's docs, Private Relay addresses only accept emails from the original developer (BuyMeACoffee). Apple silently drops the email from Stripe.

5. Because Apple doesn't bounce the email, Stripe assumes it was delivered and refuses to let you proceed until you click the link.

I am currently stuck in Stripe support hell because of this. Even though I have completed full KYC with Stripe (passport, mobile number) and phone support can verify my identity using my bank account details, they tell me they cannot change the primary email address. Their only solution so far was to tell me to contact Apple, however the ticket is still open (sco_UE0HAGOMIeJEkf if anyone from Stripe is reading).

I stumbled into this setting up a donation link for a passion project of mine (ClassicVideoPoker.com). It’s an incredibly frustrating edge case, but fundamentally, BuyMeACoffee probably shouldn't pass relay addresses to third-party payment processors, and Stripe shouldn't treat non-bouncing emails as an absolute proof of delivery when full KYC is already provided.

Posting this as a warning so others don’t follow in my footsteps, and on the off chance someone from Stripe or BMAC is paying attention.