Fraud management: Managed Challenge

On rare occasions, your pages could be subject to multiple submissions by a “bot”, most likely to a donation page. These are usually attempts to validate stolen data, such as card numbers. 

We have several measures in place (please read the fraud management article) to combat these, such as Captchas. But sometimes further measures need to be implemented to mitigate the issue.

In these cases, Engaging Networks may place a “Managed Challenge” on your page which will validate the visit and determine whether it is legitimate or not.

Why would a Managed Challenge be added?

The Cloudflare network allows Engaging Networks to enable new security protocols and utilize closer monitoring of web traffic through the domains used with Engaging Networks.

While any attacks should not get processed by your gateway (which has its own protections in place), it can mean the attempts are recorded in your account causing data problems, and in addition our reputation with the gateway could be reduced if the activity continues.

The Managed Challenge is a temporary measure and will be remove it once the attack has stopped.

What does a Managed Challenge do?

The challenge is placed on an individual page URL, or URLs, that are being subjected to the attack.

When the URL is visited, Cloudflare technology will look at the visitor and determine whether it is valid or not. For example, it can look at the IP of the visit and compare it against problem IPs, or it can determine via the method of visit whether it is a bot or not.

The challenge adds a short (around 3 to 5 seconds) delay before your page is loaded. It may also require your supporters to tick a box.

Your legitimate supporters would not be blocked by this and can continue as normal.

What does a Managed Challenge look like?

The challenge shows a page that says “Checking your browser before accessing [your url]” with some animated dots below.

After a few seconds, the page is loaded. See an example below: