hCaptcha Account Defense

hCaptcha Account Defense is an account takeover detection and prevention product that identifies unauthorized access to user accounts during login and authenticated sessions. It evaluates risk signals across authentication events and sensitive account actions to detect activity such as credential stuffing, phishing, stolen passwords, and hijacked session cookies, including takeovers that occur mid-session after a legitimate login (e.g. via malware or botnets). The product uses a privacy-preserving, blinded data approach, allowing detection without collecting usernames, email addresses, phone numbers, or other personally identifiable information. Customers can pre-blind identifiers before sending them to hCaptcha. Account Defense provides analytics, visualizations, event hooks, and APIs for investigating suspicious sessions and automating remediation, and integrates with existing security analytics dashboards and SIEM platforms. Risk data allows teams to set thresholds to allow, challenge, or block sessions based on risk level. It works with identity providers such as Okta, Microsoft Entra, and custom identity systems, using standard hCaptcha SDKs for integration. It can be paired with hCaptcha Bot Detection to identify compromised sessions and with hCaptcha Private Learning for adaptive machine learning-based fraud detection. It can also be combined with hCaptcha MFA (pull-based SMS) for additional detection signals. The vendor states the product achieves customer-validated detection rates of up to 100% and complies with regulations including GDPR, CCPA, LGPD, and PIPL.