Fraud Goes Human: Cloudflare Expands Beyond Bot Detection
Online fraud has become a dominant cost of doing business. The Federal Trade Commission reported consumers lost nearly $8.8 billion to scams in 2022, a more than 400% increase since 2019, and larger enterprises are not immune—PwC's Global Economic Crime and Fraud Survey found that more than half of companies with at least $10 billion in revenue experienced digital fraud.
Bot management has been the standard defense, but it misses a growing class of attacks. When targets are valuable enough, bad actors hire real people to exploit applications, bypassing automated detection entirely. To address this, Cloudflare is announcing Fraud Detection, a new product that provides tools to detect and categorize fraud on any website on their network. Deployable in seconds, it offers customers a choice of responses: blocking traffic at the edge, passing fraud signals upstream in headers for custom application logic, or using Cloudflare Workers to route high-risk users to an alternate experience.
The Frictionless Dilemma
Security teams often know what would stop fraud but are constrained by user experience. Requiring email verification on signup, enforcing two-factor authentication for all logins, or blocking purchases from VPNs would reduce abuse, but also add friction that can slow adoption and reduce revenue. For companies that choose to maintain a smooth UX, the cost of fraud manifests in two ways: higher infrastructure costs and less efficient employees. Attackers flood endpoints with highly distributed HTTP requests that evade IP-based rate limiting, forcing companies to scale infrastructure to serve illegitimate traffic peaks. Meanwhile, engineering and Trust and Safety teams are pulled into tasks like banning IP addresses and purging fraudulent data, becoming de-facto fraud investigators without adding value for customers.
Four Fraud Types, One Solution
Cloudflare is building detections around the four most requested fraud types:
- Fake Account Creation: Creating many accounts to abuse promotional rewards or gain excess resources.
- Account Takeover: Unauthorized access via stolen credentials, weak password guessing, or abusing recovery mechanisms.
- Card Testing and Fraudulent Transactions: Validating stolen credit card details or using them for purchases.
- Expediting: Circumventing the normal user flow to complete orders or sensitive actions faster than possible.
For the solution to be trustworthy, it must explain its decisions. When a signup attempt is flagged, customers need to know which field triggered the flag, why it was an issue, and whether it was part of a larger pattern. Cloudflare will pass this detail along with its detections.
The new signals are designed for flexibility, with the ability to be used individually or combined with other Cloudflare security products through the familiar Firewall Rules interface. Templated rules offer guidance, while customers can fully customize how to protect each application. Actions include blocking, rate-limiting, challenging at the edge, or sending signals upstream for custom in-application behavior.
Cloudflare's network sees an average of 45 million HTTP requests per second, a scale that supports highly accurate machine learning. The company has optimized its ML execution time to under 0.2 milliseconds, allowing multiple specific models to run in parallel on every request without impacting content delivery.
Stopping Fake Account Creation First
The first problem targeted is fake account creation. Cloudflare sees more signup pages than any other provider, giving it a unique vantage point. Using sampled attack data and threat intelligence from its Cloudforce One team, the company found that existing threat intelligence from Cloudflare One products already identified 72% of fake accounts based on supplied signup details like email address or domain. Additional sources are being added to push this closer to 100%, and new machine learning models are being trained on this data to spot trends in fraudulent domains across the network. Cloudflare also has the automated systems to act on this insight at scale across its user base. 
Slowing Down Expediting with Encrypted Tokens
The second prioritized problem is expediting, where attackers move through a succession of web pages faster than humanly possible, sometimes skipping steps to exploit a resource like an Account Recovery page. In one scenario, bad actors with a large list of valid email addresses spam the recovery process to identify which correspond to registered accounts for token theft.
Cloudflare's approach forces attackers to behave like legitimate users. Consider a valid password reset flow:
- A GET request to render the login page
- A POST request to the login page at least one second after receiving the HTML
- A GET request to render the Account Recovery page at least one second after the POST response
- A POST request to the password reset page at least one second after receiving the recovery page HTML
- A total process time under 5 seconds
To enforce this, Cloudflare stores encrypted data in a user token that confirms the visitor has visited the necessary pages in the correct order and timing. This token acts as a VIP pass, allowing only those who have followed the full, legitimate flow to complete sensitive actions like password recovery. Attackers are forced to proceed at a human pace, making the process of checking thousands of email addresses impossibly slow and driving them to easier targets. 
Cloudflare is developing further Account Takeover and Carding Abuse detections to be announced later. As new fraud vectors emerge, the company plans to expand its detection coverage. Interested organizations can join the Fraud Detection Early Access in the second half of 2023 by submitting contact information at cloudflare.com/lp/fraud-detection. Early Access customers can opt in to provide training data immediately, improving model effectiveness for their use cases, and will receive early access to new models and features as they roll out. 
