4 ms·
> What's wrong if a bot buys some of your inventory, pays for it and everything? 100% of the time, a bot buying things from a store is doing so to test a datab
by dangrossman 7y ago
> What's wrong if a bot buys some of your inventory, pays for it and everything?
100% of the time, a bot buying things from a store is doing so to test a database of stolen credit cards the bot's owner has purchased/stolen. Accepting those sales means you'll get hit with chargebacks a few weeks later as the real owners of those cards see their statements. Then your store gets shut down for exceeding the maximum 1% chargeback ratio mandated by Visa and MasterCard. So preventing this scenario matters a lot, and when someone targets one of my stores for testing like this, enabling a CAPTCHA on the payment page is one of several, often-essential mitigations. Blocking IPs, blocking whole countries, including a nonce in the form, etc are on their own insufficient most of the time: the readily-available tools for this kind of attack already handle rotating IPs, retrieving a new form nonce on each try, spoofing the proper referrer, etc.
- oarsinsync 7y agoDo you have any stats on cart abandonment rate, and/or how that changed after you enabled recaptcha?
- dheera 7y ago"Cart abandonment" Why is this a bot-specific thing? I abandon shopping carts as a human all the time, including especially: * If you require a registration and login to checkout * If your UI is too hard or clunky to use * If shipping fees are higher than what I think is fair * If there are additional non-upfront fees
- luckylion 7y agoI think that was the parent's point: humans will likely abandon carts more often if they need to solve a captcha to advance to the check out.
- mrguyorama 7y agoOur company has industry leading fraud rejection rates and we don't use captcha at all
- spicytunacone 7y agoWould you be able to say how your company accomplishes that?
- mrguyorama 7y agoHonestly, statistics from about 2010 (ie before the age of neural network hype) and limited human observation.
- benologist 7y agoHuman moderation and ad-hoc heuristics seems to make the difference at Reddit too, rather than the CAPTCHA at registration.
- dmoy 7y agoIn practice it is a major pain to keep up to date, and bots slip through all the time, at least on the subreddit I help moderate. It's a lot of manual volunteer work.
- judge2020 7y agoI get a recaptcha when trying to sign up for a new account: https://i.judge.sh/Flutter/45DyMRuL.png https://i.judge.sh/Flutter/45DyMRuL.png maybe this is related to some other heuristic they're using for determining whether or not to show recaptcha (although this is in a no-extension Chrome on a residential IP address).
- benologist 7y agoRight, they have that at registration but it's either superfluous or it only catches the really easy stuff because they rely on an army of human moderators who spend all day cleaning up after bad actors able to click buses.