Add additional use-cases docs by gzuidhof · Pull Request #104 · FriendlyCaptcha/friendly-docs

gzuidhof · 2026-03-18T16:43:59Z

Adds a page describing the following (and how Friendly Captcha can help):

        "use-cases/credential-stuffing",
        "use-cases/account-takeover",
        "use-cases/payment-fraud",
        "use-cases/spam-protection",
        "use-cases/api-protection",
        "use-cases/fake-accounts",

dev-love

Thank you for creating these use case drafts. I think this is a great starting point for the expansion of our Developer Hub.

dev-love · 2026-03-20T19:19:05Z

docs/use-cases/account-takeover.md

+
+[Risk Intelligence](https://developer.friendlycaptcha.com/docs/v2/risk-intelligence/) is a product that allows you to implement risk-based authentication in a matter of hours instead of weeks.
+
+Friendly Captcha assess the visitor, sharing risk scores and information about the browsing session with your backend, so you can make informed decisions about how to handle requests.


Suggested change

Friendly Captcha assess the visitor, sharing risk scores and information about the browsing session with your backend, so you can make informed decisions about how to handle requests.

Friendly Captcha assesses the visitor, sharing risk scores and information about the browsing session with your backend, so you can make informed decisions about how to handle requests.

dev-love · 2026-03-20T19:25:04Z

docs/use-cases/account-takeover.md

+
+You could for example have a policy where you require MFA for requests that have a high risk score, but allow requests with a low risk score to proceed without additional verification.
+
+Alternatively you can store information about the user's previous browsing sessions, and if a request comes in that deviates significantly from the user's normal behavior (e.g. a login attempt from a new device or location), you can require additional verification for that request.


That sounds interesting. Perhaps this anomaly detection approach deserves its own sub-section and/or an additional short explanation.

dev-love · 2026-03-20T19:26:33Z

docs/use-cases/account-takeover.md

+</p>
+
+## Passive monitoring for account takeover
+Even if you don't want to implement risk-based authentication, you can still use Risk Intelligence for passive monitoring of account takeover attempts. By logging signals associated with critical user interactions, you can analyze patterns of behavior and identify potential security threats. For example, you might notice a spike in high-risk scores from a particular network, geographic region or device type, which could indicate a coordinated attack. You can feed this data into your SIEM (Security Information Event Management) system to correlate it with other security events.


Data integration into SIEM systems has already been specifically requested by our first enterprise customers. So it’s an exciting opportunity to write a tutorial in the future and link to it from here.

dev-love · 2026-03-20T19:33:16Z

docs/use-cases/api-protection.md

+For example, you might choose to block requests that have a high risk score, you may rate limit them more aggressively, or you might require additional verification for those requests. This way, you can protect your APIs from abuse while still allowing legitimate users to access your services.
+
+## What about machine-to-machine communication?
+Friendly Captcha's Risk Intelligence is designed to protect APIs that are accessed by users, not machine-to-machine (M2M) communication. Outside of requiring authentication, assessing risk based on the IP address of the request is a common way to protect M2M communication.


Suggested change

Friendly Captcha's Risk Intelligence is designed to protect APIs that are accessed by users, not machine-to-machine (M2M) communication. Outside of requiring authentication, assessing risk based on the IP address of the request is a common way to protect M2M communication.

Friendly Captcha's Risk Intelligence is designed to protect APIs that are accessed by users.

You can assess the risk of machine-to-machine (M2M) communication based on the IP address of the request.

dev-love · 2026-03-20T19:43:51Z

docs/use-cases/fake-accounts.md

+## What about human attackers?
+While Friendly Captcha is effective at blocking automated bots, it may not be able to prevent fake accounts that are created by human attackers. While these users may be slowed down by the challenge, they can still potentially create fake accounts. 
+
+To flag these accounts for review you can use our [Risk Intelligence](https://developer.friendlycaptcha.com/docs/v2/risk-intelligence/) product, which provides you with risk scores and signals about the browsing session. This can help you identify potentially malicious users and take additional actions against them, such as flagging their accounts for review or requiring additional verification for their accounts. You can enrich the account creation process with the signals provided by Risk Intelligence, such as the user's IP address, device information, and behavior patterns, to make informed decisions about whether to allow the account creation or to flag it for review.


Suggested change

To flag these accounts for review you can use our [Risk Intelligence](https://developer.friendlycaptcha.com/docs/v2/risk-intelligence/) product, which provides you with risk scores and signals about the browsing session. This can help you identify potentially malicious users and take additional actions against them, such as flagging their accounts for review or requiring additional verification for their accounts. You can enrich the account creation process with the signals provided by Risk Intelligence, such as the user's IP address, device information, and behavior patterns, to make informed decisions about whether to allow the account creation or to flag it for review.

To prevent such fake accounts, you can use our [Risk Intelligence](https://developer.friendlycaptcha.com/docs/v2/risk-intelligence/) product, which provides you with risk scores and signals about the browsing session. This can help you identify potentially malicious users and take additional actions against them, such as flagging their accounts for review or requiring additional verification for their accounts. You can enrich the account creation process with the signals provided by Risk Intelligence, such as the user's IP address, device information, and behavior patterns, to make informed decisions about whether to allow account creation, implement additional security checks, and monitor suspicious accounts.

dev-love · 2026-03-20T19:46:48Z

docs/use-cases/payment-fraud.md

+
+Friendly Captcha can help protect against payment fraud in two ways:
+1. The Friendly Captcha widget can be integrated into your payment forms to add an additional layer of security. When a user interacts with the form, Friendly Captcha assesses the visitor and gathers signals from their browsing session. If it detects suspicious activity that is indicative of a bot, it will require the user's device to solve a computationally expensive challenge. This makes it more difficult and costly for attackers to carry out automated attacks on your payment forms, while still allowing legitimate users to access your services without friction.
+2. You can use our [Risk Intelligence](https://developer.friendlycaptcha.com/docs/v2/risk-intelligence/) product to feed our risk scores and signals into your existing fraud detection systems. This can help you identify potentially fraudulent transactions and take additional actions against them, such as flagging them for review or requiring additional verification for those transactions.


In a future version, we could expand on this or add a tutorial.

dev-love · 2026-03-20T19:48:35Z

docs/use-cases/spam-protection.md

+
+Spam is a common problem for websites and apps that allow user-generated content or have a public-facing form. Spammers can use automated bots to flood your site with unwanted content, which can degrade the user experience, damage your reputation, and even lead to security issues. 
+
+Friendly Captcha helps protect your site from spam by adding a layer of security that can distinguish between legitimate users and malicious (automated) actors. This makes it more difficult and costly for spammers to abuse your site, while allowing legitimate users to access your services without friction.


Does it make sense here to rather highlight our computational challenge/PoW approach?

Add additional use-cases docs

4b87df4

gzuidhof requested review from dev-love and greenberga March 18, 2026 16:43

gzuidhof added the documentation Improvements or additions to documentation label Mar 18, 2026

dev-love approved these changes Mar 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add additional use-cases docs#104

Add additional use-cases docs#104
gzuidhof wants to merge 1 commit intomainfrom
gzuidhof/add-use-cases

gzuidhof commented Mar 18, 2026

Uh oh!

dev-love left a comment

Uh oh!

dev-love Mar 20, 2026

Uh oh!

dev-love Mar 20, 2026

Uh oh!

dev-love Mar 20, 2026

Uh oh!

dev-love Mar 20, 2026

Uh oh!

dev-love Mar 20, 2026

Uh oh!

dev-love Mar 20, 2026

Uh oh!

dev-love Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		[Risk Intelligence](https://developer.friendlycaptcha.com/docs/v2/risk-intelligence/) is a product that allows you to implement risk-based authentication in a matter of hours instead of weeks.

		Friendly Captcha assess the visitor, sharing risk scores and information about the browsing session with your backend, so you can make informed decisions about how to handle requests.

	Friendly Captcha assess the visitor, sharing risk scores and information about the browsing session with your backend, so you can make informed decisions about how to handle requests.
	Friendly Captcha assesses the visitor, sharing risk scores and information about the browsing session with your backend, so you can make informed decisions about how to handle requests.


		You could for example have a policy where you require MFA for requests that have a high risk score, but allow requests with a low risk score to proceed without additional verification.

		Alternatively you can store information about the user's previous browsing sessions, and if a request comes in that deviates significantly from the user's normal behavior (e.g. a login attempt from a new device or location), you can require additional verification for that request.

-Friendly Captcha's Risk Intelligence is designed to protect APIs that are accessed by users, not machine-to-machine (M2M) communication. Outside of requiring authentication, assessing risk based on the IP address of the request is a common way to protect M2M communication.
+Friendly Captcha's Risk Intelligence is designed to protect APIs that are accessed by users.
+You can assess the risk of machine-to-machine (M2M) communication based on the IP address of the request.


		Spam is a common problem for websites and apps that allow user-generated content or have a public-facing form. Spammers can use automated bots to flood your site with unwanted content, which can degrade the user experience, damage your reputation, and even lead to security issues.

		Friendly Captcha helps protect your site from spam by adding a layer of security that can distinguish between legitimate users and malicious (automated) actors. This makes it more difficult and costly for spammers to abuse your site, while allowing legitimate users to access your services without friction.

Conversation

gzuidhof commented Mar 18, 2026

Uh oh!

dev-love left a comment

Choose a reason for hiding this comment

Uh oh!

dev-love Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

dev-love Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

dev-love Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

dev-love Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

dev-love Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

dev-love Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

dev-love Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants