With the recent evolution of bots, reCAPTCHA is playing a losing battle. Even basic bots and off-the-shelf programs can easily bypass reCAPTCHA. This failure to stop bots is because reCAPTCHA has not kept pace with the evolution of bots. Some of the biggest limitations of reCAPTCHA include:
High False Positives: Most often reCAPTCHA classifies legitimate consumers as suspicious. To authenticate consumers, it introduces additional and unnecessary friction which disrupts their digital journeys. This is especially true for consumers who are not Google users or use VPNs.
Vulnerable to Advanced Bots: Advancement in image recognition software means they can solve most reCAPTCHA rather easily. Today, these solvers are easy to access and acquire. A simple web search for reCAPTCHA solvers can return several results that are available for as little as $20/year.
Pricing Model: Traditionally reCAPTCHA was free. However, reCAPTCHA Enterprise comes at a cost. Businesses must pay after the first 1 million assessments per month. These costs can be significantly high for businesses that have large traffic volumes such as eCommerce, gaming, and digital banking platforms. Even after making such large investments, they can’t rest assured of robust protection against sophisticated attacks.
Same Challenges: Although reCAPTCHA Enterprise claims to have reduced the challenges that consumers dislike, it still tests the suspicious traffic with the same, old tile-based reCAPTCHA. These old challenges are no match to the advanced bots and automated scripts and continue to frustrate legitimate consumers. Businesses can create their own challenge-response mechanism or outsource them. However, it will cost them additional time and money.
Data Privacy: To make risk decisions, reCAPTCHA Enterprise collects multiple consumer data points. Several data privacy laws across the world specify how much and what type of user data businesses can collect. Using reCAPTCHA Enterprise to collect consumer data may elevate the risk of non-compliance with these laws. Instead, businesses need a solution that collects the minimum amount of PII possible for its risk decisioning.