Healthtech Firm Protects Customer Data Using Arkose Labs

Overview

The client is a major healthtech company that offers a digital health savings account (HSA) that works alongside HSA compatible plans, with an aim to make navigating healthcare easier for everyone. It offers debit processing, healthcare deductible spend tracking, and zero fees for individuals and families. The company prides itself on an intuitive digital interface.

The Business Problem

The client is known for its top-notch digital user experience and is a leader in the healthtech space. Maintaining that robust customer experience is vital in attracting and maintaining customers. However, the platform was also the target of frequent account takeover attacks, both because of its all-digital nature, and due to the valuable customer data it held being a part of the healthcare industry.

The company was initially not working with a fraud vendor, and relied on tactics like rate limiting and blocking to fight fraud. However, that affected the customer experience, such as by such as by locking good users out of their accounts. Though some level of friction is tolerated since it operates in an industry that stores sensitive customer data, the company also didn’t want an overly onerous process for customers.

Furthermore, these efforts failed to effectively fight bot attacks that targeted the platform. Fraudsters used bots to power account takeover attacks in order to obtain customer data. This information would be used by the attacker to commit downstream financial fraud, or be sold on the dark web.

The Arkose Labs Solution

After examining several vendors, the company decided to partner with Arkose Labs and deployed its platform on the company’s login and new account creation pages to solve its fraud problems. Arkose Labs’ advanced detection analysis looks at user behavior, rather than identity, to determine bot from human traffic, as well as good human users from fraudsters. Arkose Enforce, a proprietary authentication challenge, is designed to stop even the most sophisticated machine vision technology. This means bots are shut out while good users are not impacted.

Arkose Labs also collects no personal data from any user, except for IP address. This was critical for the client, which must remain in compliance with HIPAA statutes and other healthcare laws around sharing customer data.

The client also benefited from the robust data analysis and customized actionable insight into attack patterns. Other bot prevention solutions act only as a “black box;’ just telling clients how much bad traffic got through, not how or why. The client also worked closely with the Arkose Labs internal team of experts, who are able to deliver customized analysis to clients to help remediate any issues.