Financial provider: keeping solver services off a customer login

This customer is a financial provider. The login endpoint guards customer assets, which changes the threat model compared with almost any other login: the attacker's expected return per successful attempt is high enough to justify paying for tooling.

The problem

Automated login attempts routed through commercial CAPTCHA-solver services.

The economics are worth stating plainly, because they explain why an ordinary CAPTCHA does not work here. Solver services charge on the order of a dollar or two per thousand solves. Against a target where one success is worth a customer's balance, that is not a deterrent. Making the puzzle harder raises the attacker's cost by fractions of a penny and the real customer's cost by seconds. Wrong in both directions.

Why solvers beat challenges

A CAPTCHA verifies that a correct answer arrived. It does not verify who produced it.

A solver service takes the challenge, sends it to a worker or a model somewhere else, and returns the answer to the automated client, which submits it. Every step of that is legitimate from the challenge's point of view. The answer is correct.

So the detection has to happen somewhere other than the answer. What a solver cannot hide is the round trip. Getting a challenge out to a third party and the answer back in takes time, leaves a pattern in the request sequence, and often leaves traces in the client itself. Prosopo fires a detector on that path, and the block reads Solver service detected.

What the customer sees

The block response names the solver service. That is more useful than it sounds, because it tells the security team which service the attacker is paying, which in turn indicates how organised the operation is and how likely it is to adapt.

Behind the verdict, every request, fingerprint and timing signal can be broken down by request ID in the portal, so an incident review can reconstruct a campaign rather than describe it.

Results

Every one of those 22,091 blocks is a request where the challenge was answered correctly and the answer came from somebody who was paid to produce it. The argument on this page is that one, measured: a login guarding real assets attracts attackers who will buy their way past a puzzle, so the puzzle cannot be the control.

The general lesson

If the thing behind your login has a market price, assume the attacker has a budget. Detection that raises the cost of solving a puzzle is not the answer. Detection that identifies the solver in the path is.

Related

• Account takeover
• Credential stuffing
• What a CAPTCHA solver is, and how they get caught