art-of-technology/anti-fraud-skill
Overview
This skill is a multi-layered anti-fraud and bot detection system specifically for registration flows. It combines server-side tamper-proof checks, manipulation detection, and client-side behavioral signals to detect bots while minimizing false positives. The system supports shadow banning, risk scoring, honeypots, and disposable email detection for robust protection.
How this skill works
A short-lived encrypted server token seeds each form and enforces a minimum fill time. Server-side comparisons detect timing or input inconsistencies and impossible values. Client-side hooks collect behavioral signals (keystrokes, mouse movements, focus sequence, paste/autofill events, and honeypot fields) which are weighted into a risk score to decide allow, challenge, or shadow ban actions.
When to use it
- Protect new user registration and signup forms from automated abuse
- Implement bot detection and covert shadow banning to preserve UX
- Augment account creation with behavioral analysis (keystroke and mouse tracking)
- Block disposable or high-risk email addresses at signup
- Add a tamper-proof server-side layer for form integrity and timing checks
Best practices
- Never trust client-side data alone; validate tokens and timings on the server
- Use short-lived encrypted tokens (AES-256-GCM) including timestamp and fingerprint
- Enforce a conservative minimum fill time (e.g., 3s) but allow exceptions via positive signals
- Combine hardened rules (honeypots, disposable email) with weighted signals to reduce false positives
- Log decisions with consistent tags and enough context for review without storing raw keystrokes
Example use cases
- Silent shadow ban for accounts that fill honeypot fields or match disposable email patterns
- Real-time risk scoring during registration to block or allow account creation
- Detect and deprioritize scripted signups by comparing client vs server fill timing
- Improve UX for legitimate users by recognizing password managers and keyboard-only flows
- Integrate with fraud dashboards to monitor trends and tune signal weights
FAQ
Filling any honeypot field or a disposable email domain are treated as immediate critical triggers.
How do you avoid false positives for accessibility or password managers?
The system applies positive weights for password-manager-like autofill patterns and keyboard-only navigation, and uses combined signals rather than single rules to allow legitimate users.
