With the recent evolution of bots, reCAPTCHA is playing a losing battle. Even basic bots and off-the-shelf programs can easily bypass reCAPTCHA. This failure to stop bots is because reCAPTCHA has not kept pace with the evolution of bots. Some of the biggest limitations of reCAPTCHA include:

High False Positives: Most often reCAPTCHA classifies legitimate consumers as suspicious. To authenticate consumers, it introduces additional and unnecessary friction which disrupts their digital journeys. This is especially true for consumers who are not Google users or use VPNs.

Vulnerable to Advanced Bots: Advancement in image recognition software means they can solve most reCAPTCHA rather easily. Today, these solvers are easy to access and acquire. A simple web search for reCAPTCHA solvers can return several results that are available for as little as $20/year.

Pricing Model: Traditionally reCAPTCHA was free. However, reCAPTCHA Enterprise comes at a cost. Businesses must pay after the first 1 million assessments per month. These costs can be significantly high for businesses that have large traffic volumes such as eCommerce, gaming, and digital banking platforms. Even after making such large investments, they can’t rest assured of robust protection against sophisticated attacks.

Same Challenges: Although reCAPTCHA Enterprise claims to have reduced the challenges that consumers dislike, it still tests the suspicious traffic with the same, old tile-based reCAPTCHA. These old challenges are no match to the advanced bots and automated scripts and continue to frustrate legitimate consumers. Businesses can create their own challenge-response mechanism or outsource them. However, it will cost them additional time and money.

Data Privacy: To make risk decisions, reCAPTCHA Enterprise collects multiple consumer data points. Several data privacy laws across the world specify how much and what type of user data businesses can collect. Using reCAPTCHA Enterprise to collect consumer data may elevate the risk of non-compliance with these laws. Instead, businesses need a solution that collects the minimum amount of PII possible for its risk decisioning.

It is safe to say that reCAPTCHA is no match to evolving bots and automated scripts. Bots are increasingly evolving to become adept at solving puzzles. Advancement in image recognition software means automated solvers and off-the-shelf solutions can easily bypass reCAPTCHA. These solvers are easily available at ridiculously low prices and enjoy a high accuracy of over 70%.

Furthermore, reCAPTCHA risk analysis depends on Google cookies, which means consumers using Google products are highly likely to bypass the reCAPTCHA challenge.

Despite several attempts to improve reCAPTCHA with several versions, many lacunae and limitations still remain. The Arkose Labs Fraud and Abuse Defense Platform, on the other hand eradicates 100% of automated traffic and enables businesses to deflect attacks from skilled cybercriminals and human click farms. Arkose Labs goes beyond traditional fraud mitigation. We aim to deter fraud by bankrupting the business model of fraud. We erode the ROI from attacks, which forces attackers to give up on the attack and move on, all the while maintaining superlative consumer experience.

Here is how we do it:

• Accurate Classification: Arkose Labs analyzes hundreds of data points to create “telltales”, which help determine whether a consumer is suspicious or not. Our platform then segments the traffic into legitimate, a bot, or human click farm. This categorization informs the platform of any required secondary screening and the type of enforcement challenge to present.
• Challenge and Interact: To understand the intent of traffic in a deterministic way, the platform pairs secondary screening with risk assessment. It tests and challenges high-risk traffic using interactive technology, causing all automated attacks to fail. It serves increasingly complex challenges to malicious humans, which increases the amount of time and effort it takes them to complete a challenge. This delay reduces the ROI and forces attackers to abandon the attacks. Legitimate consumers may not even see the challenges and those that do can solve it in under three seconds on an average. 

The platform can customize the type of challenge according to the nature of the human-driven attack. They can also appear as brand-specific challenges, which enhances the customer experience. Unlike reCAPTCHA, we design our challenges around gamification principles that consumers find fun to solve.

• An Evolving Platform:  The Arkose Labs Fraud and Defense Platform combines risk assessments with challenges, which creates a continuous feedback loop. This continuous feedback improves fraud detection rates and decreases challenge rates for good users. It leverages embedded machine learning for advanced anomaly detection and evolving protection, taking the burden away from in-house teams. The feedback loop also ensures that legitimate consumers who do see a challenge, will not continue to do so in the future after they have solved it the first time. The Arkose Truth Data API can help send data to validate if a consumer ultimately was fraudulent or not, which can further train appropriate defenses for future or ongoing attacks. 

Clients also benefit from real-time logging (RTL), which is the detailed logs of user activity from Arkose Labs’ servers. These logs are sent to a client-specified endpoint, which may be a directly-run server or a third-party service designed to digest and package logging data for analysis.

Arkose Labs works on a no-block approach. Our Arkose Labs Fraud and Abuse Defence Platform instead challenges suspicious traffic. This approach drastically reduces false positives and improves good user throughput.

The platform provides powerful remediation and eradicates 100% of automated traffic, enabling businesses to deflect attacks from skilled cybercriminals and click farms.

To learn more about how we can help or to book a demo, click here.