E-commerce fraud is on the rise, according to 52% of respondents in a National Retail Federation survey.1 Verizon Data Breach Investigations Report findings agree, with reported retail security incidents increasing from 404 in 2022 to 725 in 2023, while confirmed breaches rose from 191 to 369.2
Retailers need more sophisticated security solutions to prevent fraud and safeguard the customer experience.
Bad bots plague e-commerce
The top concerns of retailers surveyed were account takeover and credential stuffing attacks,3 primarily driven by malicious bots. With help from generative AI, bots can begin using reconnaissance to guess passwords in addition to simple password spraying to take over a customer account and make fraudulent purchases.
But that’s not the only type of bad bot. These malicious programs are also troublesome for e-commerce:
- Scraping bots that continuously crawl websites to extract competitive data such as pricing, often causing site outages and degrading user experience.
- Reseller bots that buy up products en masse to resell at higher prices, leading to stock shortages and lost sales for genuine customers.
- Fake review bots that distort product perception by posting fabricated reviews, which impact customer purchasing decisions.
While widely used, traditional defenses such as CAPTCHAs are no longer sufficient as bots have evolved to bypass these measures with ease. Researchers found that bots solved distorted-text CAPTCHA tests correctly nearly every time, whereas human accuracy ranged from 50% to 84%. Humans were slower than bots, needing up to 15 seconds to master the challenges compared to less than a second for bots.4
Not only are many CAPTCHAs ineffective, but they also add friction for customers, risking frustration and abandonment.
Combat bot-driven fraud
Protection must be able to keep up with bots that rapidly retool to avoid detection.
F5 Distributed Cloud Bot Defense employs advanced machine learning and human experts to detect and mitigate malicious bot activities in real time, offering the following:
- Credential stuffing prevention to stop bots from testing stolen credentials, thereby preventing account takeovers.
- Inventory hoarding mitigation to block bots from tying up inventory, making certain that products remain available to legitimate customers.
- Scraping protection to prevent data harvesting, assuring top website performance and user experience.
By collecting signals on the client-side, in web and mobile apps, and analyzing those signals through machine learning, F5 Distributed Cloud Bot Defense detects bots with high accuracy and near-zero false positives.
“Retail firms that use F5 Distributed Cloud Bot Defense reduce the cost of e-commerce fraud by as much as 92%.5”
Together, these solutions provide frictionless bot protection to secure customer accounts and protect the retail experience.
Secure customer data
Bots aren’t the only perpetrators of e-commerce fraud. Client-side attacks, such as Magecart or formjacking, execute in the customer’s browser to steal sensitive information, including payment data. These attacks are difficult to detect using traditional application security, such as a web application firewall.
F5 Distributed Cloud Client-Side Defense addresses this gap by providing continuous monitoring and real-time threat detection using machine learning to block malicious JavaScript that could steal credit card details and other personal information. It also helps ensure compliance with PCI DSS v4.0.
E-commerce defense from F5 and Google Cloud
Google Cloud delivers omnichannel, frictionless customer experiences with retail solutions that are easy to deploy. Protect them with F5 Distributed Cloud Services.
The F5 Distributed Cloud Console provides unified management for Distributed Cloud Bot Defense, Distributed Cloud Client-Side Defense, and other solutions for app security, delivery, and performance to simplify IT and security operations.
F5 Distributed Cloud Services provide a consistent experience across cloud, on-premises, and edge environments to secure your apps and APIs everywhere they live.
Check out the many F5 solutions available in the Google Cloud Marketplace.
Learn more about F5 and Google Cloud at f5.com/gcp.
Sources
1. National Retail Federation, National Retail Security Survey 2023, Sep. 2023
2. Verizon, 2024 Data Breach Investigations Report, May 2024
3. National Retail Federation, National Retail Security Survey 2023, Sep. 2023
4. Andrew Searles, et al., An Empirical Study & Evaluation of Modern CAPTCHAs, UC Irvine, Jul. 2023
5. Forrester Consulting, F5 Helps Retailers Provide Omnichannel Customer Experiences While Minimizing Bot Attacks, Feb. 2022
About the Author
Related Blog Posts
F5 accelerates and secures AI inference at scale with NVIDIA Cloud Partner reference architecture
F5’s inclusion within the NVIDIA Cloud Partner (NCP) reference architecture enables secure, high-performance AI infrastructure that scales efficiently to support advanced AI workloads.
F5 Silverline Mitigates Record-Breaking DDoS Attacks
Malicious attacks are increasing in scale and complexity, threatening to overwhelm and breach the internal resources of businesses globally. Often, these attacks combine high-volume traffic with stealthy, low-and-slow, application-targeted attack techniques, powered by either automated botnets or human-driven tools.
F5 Silverline: Our Data Centers are your Data Centers
Customers count on F5 Silverline Managed Security Services to secure their digital assets, and in order for us to deliver a highly dependable service at global scale we host our infrastructure in the most reliable and well-connected locations in the world. And when F5 needs reliable and well-connected locations, we turn to Equinix, a leading provider of digital infrastructure.
Volterra and the Power of the Distributed Cloud (Video)
How can organizations fully harness the power of multi-cloud and edge computing? VPs Mark Weiner and James Feger join the DevCentral team for a video discussion on how F5 and Volterra can help.
Phishing Attacks Soar 220% During COVID-19 Peak as Cybercriminal Opportunism Intensifies
David Warburton, author of the F5 Labs 2020 Phishing and Fraud Report, describes how fraudsters are adapting to the pandemic and maps out the trends ahead in this video, with summary comments.
The Internet of (Increasingly Scary) Things
There is a lot of FUD (Fear, Uncertainty, and Doubt) that gets attached to any emerging technology trend, particularly when it involves vast legions of consumers eager to participate. And while it’s easy enough to shrug off the paranoia that bots...