Google has been defending millions of sites with reCAPTCHA for
over a decade. reCAPTCHA has become a part of Google Cloud Fraud Defense, a fraud
and abuse prevention platform for bot, account, and transaction protection across
the agentic web. With Fraud Defense, you can add a layer of
protection to your website or mobile applications against spam and abuse,
and detect other types of fraudulent activities, such as credential stuffing,
account takeover (ATO), and automated account creation.
Fraud Defense offers enhanced detection with more granular scores,
reason codes for risky
events, mobile app SDKs, Password defense, multi-factor
authentication (MFA), and the ability to tune your site-specific model to
protect enterprise businesses.

## Fraud Defense tiers

Fraud Defense offers three usage-based tiers: Enterprise,
Premium, and Essentials.

To compare features across tiers, see
[Compare features between Fraud Defense tiers](https://docs.cloud.google.com/recaptcha/docs/compare-tiers.md.txt).

## How Fraud Defense works

When Fraud Defense is deployed in your environment, it interacts
with your backend and client (web pages or mobile applications).

When an end user visits a web page or uses a mobile application,
the following events are triggered in a sequence:

1. The client loads the web page from the backend or launches the mobile application.
2. The web page or mobile application initializes the reCAPTCHA JavaScript API or mobile SDK, which begins collecting signals.
3. When the end user triggers an action protected by Fraud Defense such as login, the reCAPTCHA JavaScript API or the mobile SDK in the client requests a verdict from Fraud Defense.
4. Fraud Defense returns an encrypted reCAPTCHA token to the client for later use.
5. The client sends the encrypted reCAPTCHA token to the backend for assessment.
6. The backend sends the create assessment (`assessments.create`) request and the encrypted reCAPTCHA token to Fraud Defense.
7. Fraud Defense returns a verdict to the backend based on the evaluated risk of the request. The verdict includes a risk score from 0.0 to 1.0 and reason codes.
8. Depending on the verdict, you can determine the next steps to take for that specific user request or action.

The following sequence diagram shows the Fraud Defense workflow:

![Sequence diagram showing the interaction between the client, backend, and Fraud Defense when creating an assessment.](https://docs.cloud.google.com/static/recaptcha/images/sequence_diagramv1.svg)

## What's next

- [Test reCAPTCHA in a demo website](https://docs.cloud.google.com/recaptcha/docs/quickstart-app.md.txt).
- [Get started with reCAPTCHA](https://docs.cloud.google.com/recaptcha/docs/implementation-workflow.md.txt).
- [Find the legacy reCAPTCHA secret key for plugins](https://docs.cloud.google.com/recaptcha/docs/create-key-website.md.txt#find-key).