Google’s web security service, reCAPTCHA, has been a staple of the internet for many years. Nearly everyone who has ever gone to any website has had to click on images of crosswalks or lampposts or check an “I’m not a robot” box.
One reason for reCAPTCHA’s initial widespread use was that it was free; any company doing businesses digitally that wanted a modicum of bot protection could integrate it on the login or registration pages without investing a dime. Certainly, it makes maintaining tight fraud budgets easier.
However, that’s not entirely true anymore; Google last year released its reCAPTCHA Enterprise service, designed for large businesses with a significant amount of daily traffic flow. This service is based on reCAPTCHA V3, which Google claims aims to stop malicious traffic on websites without user interaction. Instead of showing a CAPTCHA challenge, reCAPTCHA v3 returns a type of score so website admins can choose the most appropriate action for their website
reCAPTCHA Enterprise builds on everything V3 has but is geared towards enterprises and is no longer free, but charges businesses after the first 1 million assessments per month.
This move has led many businesses to look for an alternative to reCAPTCHA. After all, 1 million calls per month is very easy to reach for most digital businesses. In fact, larger, global ones will have significantly more than that.
Part of reCAPTCHA’s appeal was that, despite its flaws, it was a free service. Now it is no longer free for the vast majority of enterprises. If businesses are going to pay for a bot-prevention service, they may as well spend on one that stops even the most advanced bots.
Limitations of reCAPTCHA:
Furthermore, for businesses that do use reCAPTCHA Enterprise, it does not differ much from the previous free services. As noted above, reCAPTCHA V3 aims to show less of the onerous challenges that consumers have grown to hate. But if suspicious traffic is detected, the service simply sends a risk score to website admins who then have little resource with how to deal with that traffic. They can outright block it, which can lead to many false positives, or implement the old reCAPTCHA challenge which is ineffective against advanced automated attacks.
Other Alternatives Beyond reCAPTCHA
Many businesses may be wondering if they could get more from a bot defense solution than the now-paid version of reCAPTCHA. After all, if you are going to pay for anti-bot technology, you might as well pay for the best and most secure.
The first thing businesses should look for in a reCAPTCHA alternative is accurate detection capabilities. As we know, today’s bots are able to mimic humans with a high degree of accuracy. That means businesses need a bot solution that can accurately tell humans apart from automation and allow good users to pass through.
However, not all traffic will be parsed into good or bad. For traffic that falls under the gray area, businesses need a solution that can stop bots in their tracks while still offering good users a chance to quickly self-remediate. reCAPTCHA is not the ideal solution for this, as it is easily bypassed by off-the-shelf bots while at the same time continually frustrating human users.
Ultimately, businesses need a platform that combines real-time intelligence, rich analytics, and sophisticated step-up challenges to eliminate attacks on consumer accounts. The platform should have the following characteristics:
- Continuously evolving detection methods that detect patterns using probabilistic, statistical, and machine learning-based models.
- Presents challenges based on the risk assessment of a user and adapts to the growing risk of the user.
- Utilizes a feedback loop between the dynamic risk engine and challenge-response mechanism to facilitate improved risk predictions.
- Provides clients with actionable insights, which include analysis of and visibility on bot vs human traffic.
