2021 Black Friday Security Guide: Does Your E-Commerce Store Need A CAPTCHA?

As the annual e-commerce bonanza approaches, everyone is getting excited. By everyone, I mean consumers, online sellers, and cybercriminals. Fraudsters and bots that disguise themselves as customers will swarm into every online store during that time.

CAPTCHA has long been a popular tool for distinguishing humans from bots. According to okta, nearly all of the top 1 million websites worldwide use certain types of CAPTCHA to detect and prevent bot traffic. But there are also voices that are skeptical about CAPTCHA's security capability and bad user experience.

Does your online store really need CAPTCHA? Will CAPTCHA protect or destroy your business?

As an e-commerce retailer, it is an urgent decision for you to make, since it's only weeks away from the big day. But hold on. Don't hurry to make a choice. The first thing to make clear is what on earth is attacking your business?

1. Security Threat Affects E-Commerce Stores

Your website is well structured; the design and images are carefully chosen; your ads attract the right people; your deals and coupons are appealing to your customers. But why is there still interference every now and then, like invalid coupons, mysteriously disappeared store inventory, a large amount of refund, etc. Those are called e-commerce fraud. There are actually many tips to prevent digital fraud out there.

According to statistics from a Forbes report, nearly all online retail stores have been impacted by e-commerce fraud.

Here's a commonly seen e-commerce fraud checklist for retailers from what I learn from 2020 online fraud in holiday shopping season.

①. Account Takeover Fraud

A form of online identity theft where a malicious actor illegally takes ownership of online accounts and gains access to confidential data.

②. Credit Card Fraud

Fraudsters use stolen card information to access batches of credit cards and then repeatedly buy things with the cards on an online shopping platform.

③. Gift Card Cracking

Fraudsters take away the benefit that retailers provide to real consumers through mass enumeration of coupon numbers, voucher codes, discount tokens, etc.

④. Denial of Inventory

An automated attack that depletes goods or services stock without ever completing the purchase or committing to the transaction. It significantly cramps online retail businesses by preventing customers from placing orders.

In the past decade, large and small online retailers have been targeted by attackers alike. Digital fraud has been on the rise, and fraudsters have been siphoning the money from online businesses for years, while the pandemic only made it worse. An IBM Security global survey found that pandemic-induced digital shopping behavior leads to long-term cybersecurity impact.

2. Dealing Online Fraud with CAPTCHA or Not?

As a widely used fraud prevention tool, CAPTCHA can be effective, but in terms of security and user experience, some people feel it falls in short. It is a prevalent but actually outdated perspective. Since bots and fraud techniques have evolved, so does CAPTCHA.

What's your impression of CAPTCHA? The hard-to-read text? Crazy hard image recognition? Those days are over. To be honest, those CAPTCHAs can hardly stop today's AI fraud and sophisticated bots.

It has been over 20 years since CAPTCHA was created. Benefiting from the rapid development of computer science, such as artificial intelligence, machine learning, deep learning, computer vision, etc, CAPTCHA has also been making progress. Apart from preventing fraud, CAPTCHA plays an important role in your marketing funnel.

Take security and user experience as examples, which are what CAPTCHA gets most criticism for, today's AI-powered CAPTCHA can perform specific and customized tasks to prevent digital fraud and meanwhile provide a more user-friendly experience.

①. Security

With AI and OCR technology, bots can solve distorted text at 99.8%. That's why CAPTCHA providers began to work on alternative forms of text-based CAPTCHA years ago. For instance, GeeTest applied AI models and behavior analysis to its CAPTCHA v1, v2, and v3 since 2012. It asks users to use their mice to respond to a CAPTCHA challenge and analyze their mouse trajectory and other data, like device information and network environment, to detect and prevent bot attacks. Such AI-driven CAPTCHA tools can deal with AI fraud issues very well.

②. User Experience

CAPTCHA requires users to interact with a challenge in order to distinguish them from bots. But a minor disruption of users' flow may lead to customer abandonment. When CAPTCHA providers can rely on data like mouse trajectory, device information, and network environment, etc, they can even replace CAPTCHA challenge with a button to click or just a checkbox, ensuring customers have a coherent experience during online shopping.

AI-powered CAPTCHA really can help retailers handle the holiday rush.

3. Meet the New Adaptive CAPTCHA

GeeTest launches CAPTCHA v4-Adaptive Verification in 2021, an innovation of security and user experience.

In terms of security, GeeTest CAPTCHA v4 adapts to various bot attacks through dynamic and active security strategies in real-time. Compared with the previous generations, CAPTCHA v4 increases the absolute attack cost of attackers by 3.714 times.

As for user experience, CAPTCHA v4 adapts to different online interactions through the modularized dynamic fitting, deeply integrated with client's business requirement, and meets the security demand for different enterprises in different industries in different life cycles.

①. More Secure

Compared with the passive static security strategy of AI-powered CAPTCHA, GeeTest v4-Adaptive Verification adopts active and dynamic confrontation, providing 7 layers of protection. The constant change of security strategy disables bot attackers and increases their attack cost.

②. More Agile

GeeTest CAPTCHA v4 makes its installation and communication flow more agile than previous generations. You can install it without SDK and only need to process three core requests to complete the integration (mobile terminal still needs SDK).

• Load request: Load validation resources, and acquire the validation question.
• Verify request: Submit the validation answer.
• Validate request: Validate the verification result.

The simplified installation and communication flow of GeeTest CAPTCHA v4 put great agility into the product, making it a lightweight and convenient tool for businesses no matter small or large.

③. More Intelligent

GeeTest provides 9 CAPTCHA forms, and the system supports the CAPTCHA form setting at any time that takes effect immediately. You can also set up CAPTCHA difficulty, and specify a period to customize CAPTCHA challenge frequency. GeeTest CAPTCHA v4's decision-making model will train itself and update the models regularly.

‍4. The Bottom Line

Over the past 9 years, GeeTest has always challenged the most essential problems in the industry with the most advanced technologies. It works on creating the most intelligent and secure CAPTCHA and bot management solution for enterprises worldwide.

It's time to set aside the bias against CAPTCHA. I believe as long as using the right and effective CAPTCHA, online retailers are going to have a safe and fruitful peak season.

Get GeeTest free account now! A 30-day free trial is available.