Stop Bot Signups: Secure Your Funnel and Sales Team

A developer friend told me the other day, “I’ve got an unsearchable, blank web page with a random form on it for a website prototype I’m building… and somehow bots are finding it and signing up!” 

We’ve been speaking with hundreds of companies, and one thing is certain: bots are becoming more frequent, becoming more sophisticated, and even more malicious. Not only can they be annoying and muddy your marketing data, but they can even create havoc with your hosting provisioning and actively try and break your software!

People call us when they’ve finally had enough or hit a critical failure–so I put this blog together to try and help people just like you (starting with Google and trying to figure out how to reclaim their funnel).

Why Bot Signups Are Bad

Data Integrity Issues

Bot signups distort your funnel data, leading to inaccurate metrics and skewed KPIs. This makes it tough to accurately assess your marketing campaigns, allocate resources effectively, and make smart business decisions. For example, a marketing campaign might look successful with high signup numbers, but if many of those signups are bots, the actual impact is much less impressive.

Here’s an example of why bots are so annoying:

1. Burst attacks:

As the figure below shows, a burst attack is when you get a sudden onslaught of bots hitting you, such that your marketing data looks so significantly different, any high level data you want to look across, particularly in graph form, becomes useless. The below is taken from one of our clients (before they became our client):

As we can see, the normal business operation of SEO clicks and impressions (via Google Search Console) become meaningless (the company has actually been improving quite drastically–although it is really hard to see). 

2. Sustained attacks

Resource Drain

Bots don’t just waste your sales team’s time—they also hog resources across all your third-party services and infrastructure. When bots infiltrate your sales funnel, they trigger various automations and workflows, from CRM updates to email sequences. This unnecessary activity leads to wasted resources. For instance, a company might spend valuable time and money nurturing leads that are actually bots, resulting in wasted efforts and missed opportunities with genuine prospects.

As a bootstrapped company we were going through massive cost consolidation, especially regarding our AWS bill. We quickly found that we were spending $5,000 on trials that didn’t even provide a valid email. RingCaptcha allows us to reduce the percentage of trials that never went anywhere and saved us thousands.

Brian Sierakowski – CEO, Baremetrics

Here’s a snapshot one of our now customers shared with us about the level of bots they are seeing. This is from their Discourse (which is a great community forum tool) admin page:

At first glance, this shows that their pageviews are skyrocketing! They exceeded their monthly pageview count by 200,000, a staggering 40% in a single month! This must mean they are going viral, right?

Wrong!

Just below, Discourse provides a handy traffic dashboard that reveals exactly what is happening (and why our client may not be so eager to agree with the upgrade):

As can be seen, ~50,000 visitors to the forum on one day alone were crawlers! We haven’t expressly confirmed this with Discourse, but it would appear that these are bots with nothing better to do than screw with your website, your product, and your metrics. 

Poor customer experience

Before this customer above became our client, they reported 1,000 signups per day on their product. After implementing RingCaptcha, they found that 80% of those signups were in fact bots! Bots that drained their infrastructure budget and drained the multi-tenant resources available to their trialers, in turn leading to a poor app experience.

Security Risks

Bot signups can exploit system vulnerabilities, posing significant security risks. These fake accounts can be used for malicious activities, such as credential stuffing, where bots use stolen credentials to sign up or log in, leading to potential data breaches. Additionally, fake user profiles might exploit free trial offers, accessing premium features without paying and potentially causing financial losses.

One of our customers reached out to us as they found that they were being used by piracy firms to ‘test’ stolen credit card information. Their signup flow was so open (because that’s what their investor advice was–’remove all friction’) that they served as the ideal flow to have bots signup and load credit card data into their plans and test to see if the charges would work. Suffice to say, this led the company to have drastically shocking signals about its signup flow (marketing celebrated, but customer success got fired for such bad net revenue retention stats!). Not only that, they ended up getting investigated by US authorities who were understandably following the trail of bank disputes for fraudulent transactions. 

Examples of Frauds and Vulnerabilities on Signup Pages

1. Automated Bot Attacks: Bots use scripts to create multiple fake accounts, exploiting signup forms that lack CAPTCHA or other verification methods. This allows them to flood your system with bogus signups.
2. Credential Stuffing: They use stolen credentials to sign up or log in, taking advantage of weak password policies and the absence of multi-factor authentication. This can lead to unauthorized access and data breaches.
3. Fake User Profiles: Bots create fake profiles to exploit free trial offers, bypassing signup forms that don’t require phone verification or manual review. This results in misuse of your services and potential financial losses.
4. Resource Exhaustion Attacks: They can overload systems by generating a high volume of signups, causing legitimate users to experience delays or downtime. This attack strains your infrastructure and increases operational costs.

Introducing RingCaptcha’s Widget

RingCaptcha offers a powerful solution to effectively combat bot signups. The RingCaptcha widget integrates seamlessly into your existing signup forms, adding an extra layer of security with phone number validation. This simple yet powerful tool ensures that only genuine users can complete the signup process, keeping your data clean and your funnel secure.

Benefits of Using RingCaptcha

1. Stop Bots
   • Phone Validation: Phone validation is significantly harder to bypass than email validation. This makes it an effective deterrent for bots.
   • Rate Limits: RingCaptcha implements rate limits to prevent multiple signups from the same source. This further reduces the risk of bot signups.
   • Companies that implement RingCaptcha see a 90% reduction in bot signups on average.
2. Stop Time Wasters on Funnel
   • Quality Leads: Ensuring that signups are from real users improves the quality of your leads.
   • Sales Efficiency: Sales teams can focus their efforts on genuine prospects. This enhances productivity and efficiency.
3. Get Phone Numbers for Immediate Follow-Up
   • Speed to Lead: Quick follow-up is crucial for converting leads. According to an HBR article on sales best practices, contacting a lead within an hour increases the chances of qualifying the lead by 60 times when compared to contacting them after 24 hours.
4. SMS Availability for Prospects
   • High Open Rates: SMS messages are opened 4.5x more than emails. This makes them a highly effective communication channel.
   • Engagement: Higher response rates and quicker interactions lead to better engagement with prospects.
5. Phone Numbers for Enrichment
   • Reliable Segmentation: Phone numbers provide more reliable segmentation than email addresses. This allows for better-targeted marketing efforts.
   • Data Enrichment: Enhancing customer profiles with verified phone numbers leads to more accurate and effective marketing strategies.

Security Measures in RingCaptcha

1. Rate Limits: Prevents multiple signups in a short period from the same IP address. This reduces the risk of automated bot attacks.
2. Website Scanning for Fake Numbers: Identifies and blocks fake phone numbers, ensuring that only genuine users can sign up.
3. Number Lookups to Check for Real Numbers: Verifies the authenticity of phone numbers during signups. This prevents fake accounts.
4. Country Limits: Restricts signups to specific countries. This prevents fraudulent signups from high-risk regions.
5. IP Blocking and Blacklisting: Blocks known malicious IP addresses. This further protects your signup process.
6. Threat Level Checks: Continuous monitoring and assessment of potential threats. This ensures ongoing security.

For more insights into how RingCaptcha defends against resource exhaustion attacks, you can read this article.

Conclusion

Bot signups can wreak havoc on your business by distorting data, wasting resources, and posing security risks. But fear not! RingCaptcha is here to save the day. With awesome features like phone validation, rate limits, and real-time threat detection, RingCaptcha makes sure your signups are the real deal. This means a cleaner funnel and a more efficient sales team.

And here’s the kicker: for the cost of just two developer hours a month, you can shield your business from the bot signup invasion. Say goodbye to fake signups and hello to a more secure and productive sales process.

So why wait? Integrate RingCaptcha today and take the first step towards a cleaner, more reliable sales funnel. Protect your data, save your resources, and empower your sales team to focus on what really matters – converting real prospects into loyal customers.