Best practices for protection from automated threats

This document describes the recommended implementations of reCAPTCHA and fraud mitigation strategies to defend against the critical automated threats (OWASP Automated Threats (OAT) to Web Applications). Enterprise architects and technology stakeholders can review this information to make an informed decision about the reCAPTCHA implementation and fraud mitigation strategy for their use case.

This document contains the following information for each type of threat:

  • Optimal implementation of reCAPTCHA. This implementation is designed with the relevant features of reCAPTCHA for the best fraud protection.

  • Minimal implementation of reCAPTCHA. This implementation is designed for a bare minimum of fraud protection.

  • Recommended fraud mitigation strategies.

Choose the implementation and fraud mitigation strategy that best fits your use case. The following factors might influence the implementation and fraud mitigation strategy that you choose:

  • Organization's anti-fraud needs and capabilities.
  • Organization's existing environment.

For more information about the fraud mitigation strategies for your use case, contact our sales team.

Carding

Carding is an automated threat where attackers make multiple payment authorization attempts to verify the validity of bulk-stolen payment card data.

Minimum implementation

  1. Install checkbox site keys on all pages where end users need to enter their credit card information. To learn how to install checkbox site keys, see Install checkbox site keys (checkbox challenge) on websites.

  2. Create assessments for all tokens. To learn how to create assessments, see Create an assessment.

Optimal implementation

  1. Install score-based site keys on all pages where end users need to enter their credit card information. Specify an action in the action parameter such as card_entry. To learn how to install score-based site keys, see Install score-based site keys (no challenge) on websites.

  2. Install reCAPTCHA for the payment workflow on your website. To learn how to protect your payment workflow, see Protect payment workflows.

  3. Create assessments for all tokens, and set expectedAction to match the value of action that you specified when installing the score-based site keys. To learn how to create assessments, see Create an assessment.

  4. Save all assessment IDs and annotate the assessments that turn into fraudulent purchases or chargebacks as fraudulent. To learn how to annotate assessments, see Annotate an assessment.

Fraud mitigation strategy

After you implement reCAPTCHA, use one of the following fraud mitigation strategies to protect your website from carding:

  • Install reCAPTCHA for the payment workflow on your website. To learn how to protect your payment workflow, see Protect payment workflows.

  • Configure card management APIs to ensure that the reCAPTCHA tokens are valid and the scores are greater than their threshold value.

    If the scores do not meet or exceed the specified threshold value, do not run a card authorization or allow the end user to use the card. When possible, allow the transaction to proceed at time of purchase, but cancel the transaction later to avoid tipping off the attacker.

  • When creating assessments, ensure that your assessments meet the following criteria for a successful transaction:

    • All assessed tokens are valid and have a score greater than a specified threshold value.
    • The value of expectedAction matches the value of action that you specified when installing the score-based site keys on your web pages. To learn how to verify actions, see verify actions.

    If a transaction does not meet these criteria, do not run a card authorization or allow the end user to use the card. When possible, allow the transaction to proceed at time of purchase, but cancel the transaction later to avoid tipping off the attacker.

Card cracking

Card cracking is an automated threat where attackers identify missing values for start date, expiration date, and security codes for stolen payment card data by trying different values.

Minimum implementation

  1. Install checkbox site keys on all pages where end users need to enter their payment details, including both checkout and add payment method functions. To learn how to install checkbox site keys, see Install checkbox site keys (checkbox challenge) on websites.