How to handle low score of Recaptcha v3

Question

I implemented Captcha v3 on my site in the following areas with their appropriate Google specified actions:

• Login
• Register
• Homepage
• Subscription Purchase
• Main "do the thing" page of the application, in other words where the magic happens.

But what should happen if I detect a low score? Meaning Google thinks the user is either spam, bot or a security risk.

I can think of these options:

• Display a message inline ie "Suspicious behavior detected. Please try again later. Contact support link"
• Throw them over to a new page with a similar message and log them out.
  • Ask them to verify they're identity another way, ie email confirmation or SMS.

Has anyone learned any lessons on handling low scores and providing the best experience? -

Answer 1

Here are my suggestions, I hope this is useful!

Display a message inline ie "Suspicious behavior detected. Please try again later. Contact support link"

This is a sure way to annoy a user really quickly. The nature of the error has to be communicated clearly the user can look up what's wrong. (for example you tell them the error code and make the code a clickable link that redirects them to the support page explaining what the issue is and the following steps to solve it)

Throw them over to a new page with a similar message and log them out.

That is a bit aggressive. It's kind of the same user flow as above but just extending it.

Ask them to verify they're identity another way, ie email confirmation or SMS.

This might be the right track. You can use a combination of the first and the third method to provide a well rounded explanation of the issue:

"We noticed unusual activity on your account, please confirm identity and review your security settings". And then offer the option of SMS or email confirmation.