How To Protect Retail Businesses From Bad Bots This Holiday Shopping Season

Retailers are getting ready for the year’s busiest holiday shopping season, as consumers prepare to splash over $1,000 each on average, according to Deloitte.

While busy trading periods often mean a spike in traffic and sales, they are also the time when cyber threats intensify. The key challenge retailers face is identifying legitimate customers from the influx of malicious, non-human users.

Our new research found online retailers across the world are targeted by over half a million Ai-driven attacks every day, so ensuring cyber defenses are in place to protect platforms, data and customers is not just a precaution – it’s a necessity

Pre-Christmas sales trifecta driving unpredictable traffic

Six in ten Australians plan to complete their shopping by the end of November this year, to coincide with online sales such as Click Frenzy, Black Friday and Cyber Monday, according to CPM Australia.

Imperva analysed traffic to online retailers during the peak shopping months of October and November 2023, and found the volume and behaviours of online users on any given day was unpredictable. For example, Sunday 19th November 2023 saw the highest traffic level of the entire season – a huge increase of 54% – five days before Black Friday.

Ultimately, retailers need to be ready at any time, often without notice, to handle increased load – and increased threats – without compromising performance.

Counterfeit users causing chaos

While an influx of website traffic is every retailer’s goal, the excitement can easily distract from the reality that not everyone is who they say they are.

The ongoing thirst for data to train generative AI and large language models (LLMs) resulted in Australia’s retail industry reporting one of the highest proportions of simple bot traffic (87%) last year. Those seeking data to train their LLMs use web scraping bots and automated crawlers to feed training models. On the flip side, GenAI’s code generation abilities enable less technical users to write automated scripts for their own use, effectively creating their own simple Bot. Bot attacks have become so prevalent the retail industry experiences an average of 101,950 incidents daily.

What’s more, 15% of Australia’s ecommerce website traffic is associated with bad bots that work to exploit vulnerabilities and disrupt eCommerce operations – often by mimicking human behaviour. Bad bots in particular leverage application and API vulnerabilities and gaps in business logic to target high-demand products, new user discounts, and engage in price scraping, among many other common threats.

If you can’t beat them, manage them

As we approach the holiday season, retailers should have an effective bot management strategy in place that safeguards against malicious bot traffic and ensures a smooth customer experience:

1. Identify risks and evaluate traffic: identify low hanging targets such as login endpoints, account creation pages, payment forms, and product registration pages. Establish request rate baselines for each of these areas and monitor for any anomalies or spikes. Unexplained surges in traffic can indicate unwanted bot activity.

2. Identify entry points: APIs and mobile applications are common gateways for bots to access sensitive data. It is important to ensure that digital entry points are secured with strong authentication, access control, encryption, and rate limiting.

3. Block outdated user agents: many bots identify themselves as outdated browser versions having known vulnerabilities. In contrast, human users are typically forced to auto-update their browsers to the latest version to address known vulnerabilities.  Blocking user-agent strings associated with browsers that have been ‘End of Life’ for more than three years and requiring CAPTCHA verification for those two years past their End of Life is an effective way to mitigate bot traffic, and do so with minimal to no impact on legitimate users.

4. Limit proxies: bots often use proxy services to obscure their true origins by rotating through IP addresses provided by bulk IP services. Restricting access from known bulk IP data centers can help counteract this as limiting traffic from these sources can significantly reduce the likelihood of bot traffic infiltrating an eCommerce site.  Leveraging a solution with a strong reputation intelligence service can greatly reduce unwanted proxy source traffic and other known bad sources of request traffic.

5. Implement rate limiting: this is critical for managing traffic flow and preventing bots from overwhelming a website’s infrastructure. By setting a maximum number of requests that a user (not IP!) can make within a specific timeframe, retailers can protect their resources and ensure their site remains responsive to genuine customers.

6. Look out for signs of automation and headless browsers: many modern bots use headless browsers — such as Puppeteer, Selenium, and WebDriver — that simulate human behavior while automating interactions with your site. Looking for behaviours like rapid click through rates, navigating through pages too quickly, or the consistent and unusual accessing of specific resources can help identify and block headless browsers before they can cause harm.

There is no blueprint when it comes to preparing for the holiday shopping season, but it is critical retailers take proactive steps to assess and interpret the potential risk to their bottom line. As bad bots continue to grow in scale and sophistication, investments in bot management and API security are key to effectively combat the threat and ensuring retail businesses thrive during the holiday rush.

Reinhart Hansen is Director of Technology, APJ for Imperva, a Thales company.

Last Updated on November 8, 2024 by Reinhart Hansen