How Caribou Coffee uses reCAPTCHA Enterprise to create safe and frictionless digital experiences

Like most businesses, we are constantly evolving and innovating to keep pace with the digital world. Last year, many experiences we had with our customers shifted to being online. And while our virtual customer interactions increased, so did attempted attacks. We needed to secure our customers’ experiences while simultaneously not disrupting them. Today, we’re going to share with you why Caribou Coffee chose to use reCAPTCHA Enterprise to protect its most important web pages. 

We started using reCAPTCHA Enterprise to initially protect our Contact Us page, a space where customers could reach out to us with questions or feedback. We then added reCAPTCHA Enterprise to our customer loyalty page, a page where frequent customers could receive perks  such as birthday drinks. We added reCAPTCHA Enterprise to these two pages because they were targets for account takeovers, an attack where bad actors repeatedly reuse stolen credentials until they can get into accounts.

Because we know that users generally struggle with passwords, either reusing the same password across multiple sites or creating easy passwords, we didn’t want to make these webpages vulnerable to account takeovers. We decided to install reCAPTCHA Enterprise on these two pages because we liked how its adaptive risk analysis engine could detect abusive behavior without disrupting the experience we built for our end users. In addition to reCAPTCHA Enterprise, we send login confirmation emails for each successful customer sign on. reCAPTCHA Enterprise and that email brought the number of account takeovers targeting these systems to zero. 

Because of this impact, we expanded the number of webpages that reCAPTCHA Enterprise protected. Next, we put reCAPTCHA Enterprise on our gift card redemption webpage. We needed to protect this webpage from carding, an attack where a malicious person steals credit card numbers, verifies their activation, and then uses them to buy prepaid gift cards. 

Our gift cards have the card numbers and a pin on the back of the card. For our customers to redeem their gift cards, add more money to their gift cards, or check the remaining balance on a gift card, the customer must enter their gift card number and pin. 

Some of the older versions of our gift cards didn’t have pins. This left our customers with little and inconvenient options. They either had to visit a store, which could be inconvenient, or they had to contact our customer service team, which was a poor use of everyone’s time. reCAPTCHA Enterprise offered us a solution. 

After we installed reCAPTCHA Enterprise on our gift card redemption webpage, we also added MFA (multi factor authentication). In the event that gift card numbers and pins were intentionally or unintentionally repeatedly entered, an email to the end user would confirm their identity.

In addition to the email, we also rely on the threshold we’ve set by reCAPTCHA Enterprise’s risk scores. These scores, ranging from 0-1, allowed us to fine tune the webpage to a score that gives us confidence that a valid customer is using our website. If a customer interaction gives us a score below our threshold, we do not allow them to proceed on the webpage.

Promoting our brand is very important to us, so we appreciated that not only could we use MFA and send emails, but we had control over the way our emails to our customers looked. We customized our emails with our logos and “CariBLUE” color scheme. We also appreciated that Google honored all of our email settings while still sending emails to our customers from Google servers.

reCAPTCHA Enterprise’s integration with multi factor authentication and built-in risk scores have reduced issues for our security team and improved our relationship with our customer service team. reCAPTCHA Enterprise brought the number of unsuccessful gift card balance lookups to nearly zero. A low number tells us that these are legitimate customers because hits from fraudulent scripts or actors would give us a much higher number. Actual customers visiting our web page means our security team doesn’t have to spend time investigating or responding to attacks, and we can spend our time being more proactive.

Additionally, we impressed our customer service team with how reCAPTCHA Enterprise could detect and stop carding, allow valid gift cards to be used, and not disrupt the customer experience they’ve created. And, reCAPATCHA Enterprise on the gift card redemption page also saved our customer experience team time. 

If there are 50 card lookups a day on our website, and a customer spends an average of 8 minutes a call with one of our customer representatives, that is 1,200 minutes a month. This equates to 5 weeks per year being saved and reallocated in customer service time. For example, the hold time decreased because our customer representatives were not busy assisting customers with gift card issues. And my personal favorite, because I do work for a coffee company, is that we get our customer service calls back to focusing on coffee questions and guest feedback. 

In addition to using reCAPTCHA Enterprise’s risk scores to help us interpret actions on our gift card redemption page, we also use reCAPTCHA Enterprise’s reason codes. Reason codes are all logged on the backend. Only our security team can see why a particular interaction with our website, such as looking up a gift card or transferring a balance, gives us a specific reason code. Our customers receive a generic, on-brand error message. 

The reason codes, just like the risk scores, help us determine if a customer should be permitted to use our webpage. If an action, such as looking up a gift card, logging in, resetting a password, or transferring a balance, gives us a certain reason code, such as unexpected usage patterns or too much traffic, we do not let this user continue interacting with our web page.

Getting started with reCAPTCHA Enterprise was straightforward due to its documentation and the examples in documentation. It was easy for us to create assessments and interpret the product’s findings in the dashboard. We also enjoyed not having to deal with node packages getting all our tokens.

Since using reCAPTCHA Enterprise, we’ve significantly decreased some of the most prevalent forms of online fraud targeting our web pages. We increased the amount of time our customer service team and other business units have for their business priorities. reCAPTCHA Enterprise gives us usable and easy-to-understand feedback with the reason codes and risk scores that help us proactively engage with our web pages instead of responding to incidents. All in all, the product has helped Caribou Coffee get back to what it loves the most: creating day making experiences that spark a chain reaction of GOOD.