Fraud Defense (reCAPTCHA)

$100 for two days for reCAPTCHA Enterprise API. But I haven't used this API at all. Help me get my money back please. Tell me where to go with this question please.

I have a Google Enterprise ReCaptcha accountI am trying to setup a Organization for a new Workspace but when I put in my domain it says:"This domain name is already in use. If you own this domain and would like to use Google Workspace, please follow the steps here"I am not sure who used my company domain, I am with Web support implementing recaptcha for the company, how do I find out the owner email who set the Workspace up for "epsilon.com"?Are there tools that help find out the email owner so I can reach out to use this Workspace account?

I am working on implementing reCAPTCHA Enterprise and was wondering what the difference in performance is when using reCAPTCHA Enterprise out of the box v.s. providing annotations. I also am curious where the annotation data that your provide goes. Does it only go toward training your site specific model, or does the information also train the global model?

Google Cloud | reCAPTCHA Frequently Asked Questions (for additional FAQs visit our support page!)   Question: Can I use reCAPTCHA Enterprise globally? Answer: Yes, please use www.recaptcha.net in your code in circumstances when www.google.com is not accessible. First, replace <script asrc="https://www.google.com/recaptcha/enterprise.js?render=<SITE_KEY>" async defer></script> with <script src="https://www.recaptcha.net/recaptcha/enterprise.js?render=<SITE_KEY>" async defer></script>, substituting your Site Key for <SITE_KEY>. After that, apply the same logic to everywhere else that uses www.google.com/recaptcha/ on your site.   Question: Does reCAPTCHA Enterprise use cookies? Answer: reCAPTCHA Enterprise sets a necessary cookie (_GRECAPTCHA) when executed for the purpose of providing its risk analysis. If you prefer to not use the www.google.com domain which may have other cookies set, you can use www.

Hi everyone!We've seen a sharp uptick in Spam sent via our Application which is behind reCAPTCHA v3 (non interactive) on about August 18th.Since then (according to the reCAPTCHA metrics) nearly every interaction has been classified as "Low Risk".In the graph below (showing 2 weeks) you can very clearly see a 'daily' ebb and flow of users as well as lower low-risk traffic on Weekends (August 12th and 13th).However on the 18th that daily pattern very abruptly stopped and so did any "Medium" or "High" classifications.Since then we've been getting complaints from customers that our application is sending out spam.It looks like within the last 2 or 3 hours ratings seem to have finally come back.I just wanted to put this out here and see if anyone else has seen a similar pattern during this time?Here's another chart, this time going about a month back:Cheers,Dominik

Yesterday we migrated to reCAPTCHA Enterprise according to this document https://cloud.google.com/recaptcha-enterprise/docs/migrate-recaptchaWe do see the key under the Enterprise section, but when we try using it with grecaptcha.enterprise.execute method, it doesn't return us with the token. We're unsure of the reason, as we did everything according to the documentation. When we use this method with another two testing keys (also under the Enterprise section), it works as expected but doesn't with the key after the migration.Has anyone encountered such a problem?

Hello,I am building a backend that deals with requests from the frontend containing a Recaptcha token.I use the Python package google-cloud-recaptcha-enterprise to create the assessment and do the validation.I would like to implement automated tests for this backend. I have a testing Recaptcha site key, but I don't know how to deal with the token.Is there any way to have static test tokens that I could use in those automated tests?Otherwise, I have seen this selenium option proposed in the snippets, I am not sure, I might also simply deactivate the token check for the automated tests.

Hi,How we can update the domain list on admin console via automation? do Google provides API's to update the domains?Thanks!!

After following the docs here, I am getting the below error. This error does not make sense as I am using the exact same access token creation process as I am for GIP tenant creation and it works just fine there.Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential.My body looks like thisdef build_body(params) { :idToken => params[:id_token], :tenantId => ::ENV.fetch("DEFAULT_SHARED_GIP_TENANT"), :phoneEnrollmentInfo => { :phoneNumber => params[:phone_number], :recaptchaToken => params[:recaptcha_token] } }.to_jsonend My enroll call:def enroll(body) access_token = ::Actions::Gip::AccessToken.new.call.success ::Net::HTTP.post( URI("https://identitytoolkit.googleapis.com/v2/accounts/mfaEnrollment:start"), body, { :Authorization => "Bearer #{access_token}", "Content-Type" => "application/json" } )endMy access token action:def fetch_token(js

I'm using identity platform to log a user in with MFA. i'm using the javascript sdk and i can see the network request to v2/accounts/mfaSignIn:start fails with the error below. recaptcha seems to work fine and mfaSignIn:start includes the recaptcha token. an earlier call to v3/relyingparty/verifyPassword also works fine and uses the same API key and service. it just started happening today and has been on and off, so i don't think it's something on my end. Logs explorer in the Cloud Console doesn't show any more information about the error. The error is occuring across multiple projects and multiple organizations."The phone verification request contains an invalid application verifier. The reCAPTCHA token response is either invalid or expired."

Hi,My application is based on java 8 , grails 2.4.3, and postgresql. The java based application is using hibernate ORM and spring is embedded. I have a requirement of implementing google recaptcha enterprise version in the application. We do have google recaptcha implemented with the grails plugin mentioned here https://plugins.grails.org/plugin/iamthechad/recaptcha but same would not be applicable for enterprise version. Because the code inside the plugin  seems to be for non enterprise version. So with the project configuration available what all my option to implement the recaptcha. Any suggestion? Thank you in advance!

We have to migrate from the non enterprise version of recaptcha to enterprise one. What I can see in the documents is that the migration of keys can be carried out using a command. which looks good! however there is a page which says "Using reCAPTCHA Enterprise features after migration" and inside the page we have been asked to instrumenting the pages. But in the project we have integrated recaptcha (already a non enterprise version) I do not have them explicitly mentioned to be instrumented. like below file needs to be replaced by https://recaptchaenterprise.googleapis.com   https://www.google.com/recaptcha/api.js or any explicit call for any of the API mentioned below needs to be instrumented grecaptcha.execute() -> grecaptcha.enterprise.execute() grecaptcha.getResponse() -> grecaptcha.enterprise.getResponse() grecaptcha.ready() -> grecaptcha.enterprise.ready() grecaptcha.render() -> grecaptcha.enterprise.render() grecaptcha.reset() -> grecaptc

I'm trying to integrate google recaptcha entreprise in a next.js app, when I use a non test key, the returned token is always null, however it's returned fine when I use a test key. What is the problem please.Here is the github link for the repo: https://github.com/Seif-apprentus/Next-JS-Landing-Page-Starter-Template/blob/master/src/pages/login/index.tsx

Hello,I have implemented recaptcha for a web page with a form.When I run locally from file in my browser I got the token but the validation is saying browser error.When I host in Azure I always get a null token despite I have a * for CORS domain.Can you please help?I have tried both version 3 and enterprise.this is the snippet of the call with version 3:grecaptcha.ready(() => {              grecaptcha              .execute("reducted")              .then((token) => {Adding an action on the execute call does not change anythingThanksLuigi

I have a web page with Google reCaptchav3. It allows to input an ID number, click a button and requests from database some results. If a user input an ID number and click the button, then it generates one reCaptcha token.An ethical hacker is requesting a LIST of ID numbers with just one token and implies to me that I should program my web page in order to prevent that.How could I prevent or avoid in my web page that a bot or hacker input a list of ID numbers using only one token? Honestly, I thought that was Google reCaptcha job. Thanks. 

I have set up recaptcha verification in my android app. It runs smoothly on all android devices except for HarmonyOS 3.0.0 (should be a fork from Android 12 by Huawei).I am using the package com.google.android.recaptcha. In HarmonyOS, it returns an exception RecaptchaException: Key type invalid. I have confirmed from the google cloud console that the key is a valid android site key, and this key works perfectly on other android devices except for HarmonyOS.My users who use a Huawei device face this problem since Huawei installs HarmonyOS on all of its smartphones.The code and the error:The "About" page of the Huawei device:Any ideas? Thanks so much

Want to know which API we are using to fetch keys present for the below Query for the below table under findings  If i click on finding name i can see json response and in the json response there is one key " mitreAttack" Query : In which API response i can get this key and how is response gets populated for this key

Greetings!I'm experiencing an issue when signing up for reCAPTCHA Enterprise that is needed to implement reCAPTCHA on iOS app. I have  fillied up sign up form, but twice didn't received any answer. Nothing in AntiSPAM too. Thanks in advance for help.

Hi. We have been using reCaptcha enterprise on our site for years. 3 weeks back suddenly recpatcha started marking nearly every interaction as high risk. Its blocking almost all legitimate users from filling query forms on the website. What do we do about it?

Guys, I have no idea where I should put this questionLast month we received an e-mail telling us that our reCaptcha quota had been exceeded and we had 90 days to upgrade do Enterprise. Yesterday we received the second e-mail. In both e-mail we had over 1 million requests per month, and that number does not match our traffic volume. We use reCaptcha in our Azure AD B2C license. The url is similar to "https://mycompany.b2clogin.com/mycompany.onmicrosoft.com/etc"  and all the other Azure AD B2C clients have their instances running in a URL similar to that "companyname.b2clogin.com/etc"This alert started when we implemented reCaptcha in our Registration form. We know that roughly 20k users get to this page monthly. We have the following questions before upgrading to Enterprise (because something seems to be wrong):1- what counts as a request for reCaptcha V2? If the widget is printed, the user interacts with it and then our backend verify the token, then 1, 2 or 3 reque

My clients with slow internet connections have encountered issues with passing reCaptcha. The issue can be reproduced by throttling internet connection speed (for example, to 2G) and attempting to pass reCaptcha. Requests to the reCaptcha API are aborted after 5 seconds on slow connections. I have tried to find a way to override this 5-second abort, but there is no information about it in the reCaptcha documentation.I would like to know if there is any way to increase this 5-second abort or some other way to handle slow internet connections in this case?Reproducible on demo (https://www.google.com/recaptcha/api2/demo) by throttling download speed to 40kbits and upload speed to 10kbits.    

The example provided on reCAPTCHA Enterprise frictionless assessment, uses the following rule to detect an action on the login page and allows it:request.path.matches(\\"/login.html\\") && token.recaptcha_action.score >= 0.8However, is not clear if the request.path on the rule refers to a Front-End (website) route or a backend route. If it refers to the latter: What is needed to craft an equivalent rule for a GraphQL endpoint? on GraphQL there is a single path /graphql using always the POST method for all the actions.Would be the rule below enough?token.recaptcha_action.action === 'login' && token.recaptcha_action.score>= 0.8What if an attacker decides to call directly to the API where reCAPTCHA Enterprise doesn't exists? Maybe I am missing some piece of information but I don't see how the tool would solve this problem for a GraphQL endpoint.Any comment is greatly appreciated! 

We are new to using reCAPTCHA enterprise and wanted to see if anyone has had firsthand experience on how to handle a situation when the reCAPTCHA endpoints are unavailable?Was there any try catch type code added to the webpage to avoid having issue at a later date?

Hello,I have implemented repatcha enterprise with the the score based assessment on on a register page.  At first a test website.Now I wonder what would be a non fraudulent score. If I use my email address I get a score of 0.89.Would it be ok if I assess all scores >= 0.7 as non-fraudulent? What would be a good starting point as a minimum score?I could log the scores and then compare the values over time. So I may could see what is a good minimum score.On the recaptcha enterprise website it states:"With low scores, require MFA or email verification to prevent credential stuffing attacks."Where could I set up MFA or email verification? Is there a documentation about it?Thank you for any recommendations. 

We had reCaptcha free for years. Around 6 months ago we've got notification that we are above the free threshold and we should move to the enterprise. In the last emails we had info that we have 800k above the limit (so in total 1.8M). 800k costs around 800$. We've moved to the enterprise version, had info that etimated billing is around 600$. Now after few days of usage estimated is 8000$. Hard to find explanation in the portal about the source of this spike. No spike in traffic, almost same levels as before. How to approach it?