The Silent Fraud Ring That Maintained a 0.9 reCAPTCHA Score
The Silent Fraud Ring That Maintained a 0.9 reCAPTCHA Score
Your online banking platform uses Google reCAPTCHA Enterprise on wire transfer submissions. The system returns a continuous risk score from 0.0 (likely a bot) to 1.0 (likely human), with a configured threshold: transactions scoring >= 0.7 are approved immediately, while transactions scoring < 0.7 are challenged with multi-factor authentication (MFA). Over a two-month period, an organized cybercrime ring drains $4.2 million from compromised business accounts without triggering a single MFA prompt: every fraudulent wire transfer consistently received an pristine reCAPTCHA trust score between 0.85 and 0.95. Forensic analysis reveals that the attackers used custom browser automation profiles (Puppeteer Stealth) with synthetic mouse trajectory curves (Bézier spline smoothing), executed over residential ISP connections, using aged legitimate Google browser sessions, and hired cheap human CAPTCHA-solving farms (2Captcha/Anti-Captcha) to prime their browser trust cookies prior to launching attacks. You are tasked with analyzing the blind spots of client-side behavioral risk scoring and architecting a defense-in-depth anti-fraud pipeline that combines client risk signals with server-side transactional telemetry.
The Silent Fraud Ring That Maintained a 0.9 reCAPTCHA Score
Your online banking platform uses Google reCAPTCHA Enterprise on wire transfer submissions. The system returns a continuous risk score from 0.0 (likely a bot) to 1.0 (likely human), with a configured threshold: transactions scoring >= 0.7 are approved immediately, while transactions scoring < 0.7 are challenged with multi-factor authentication (MFA). Over a two-month period, an organized cybercrime ring drains $4.2 million from compromised business accounts without triggering a single MFA prompt: every fraudulent wire transfer consistently received an pristine reCAPTCHA trust score between 0.85 and 0.95. Forensic analysis reveals that the attackers used custom browser automation profiles (Puppeteer Stealth) with synthetic mouse trajectory curves (Bézier spline smoothing), executed over residential ISP connections, using aged legitimate Google browser sessions, and hired cheap human CAPTCHA-solving farms (2Captcha/Anti-Captcha) to prime their browser trust cookies prior to launching attacks. You are tasked with analyzing the blind spots of client-side behavioral risk scoring and architecting a defense-in-depth anti-fraud pipeline that combines client risk signals with server-side transactional telemetry.
Provide 1–2 precise sentences for each architectural dimension. Each box guides you on what staff-level interviewers evaluate.
Define SLA targets, hard consistency constraints, and conditions the system must never violate.
Quantify throughput (QPS/RPS), read:write ratios, and peak burst multipliers.
Step-by-step path: client ingress → API gateway → queues → background workers → persistence.
Database engine, table schema, partition keys (PK/SK), and durability strategy.
What resource hits saturation first under 10x traffic? (CPU, disk IOPS, connection pools, network).
Worker crashes, network partitions, split-brain, poison pill DLQ, retries, and idempotency.
What did you sacrifice in exchange and why? (e.g. eventual consistency vs latency, cost vs redundancy).