Every CAPTCHA you show is a small tax on conversion. Some percentage of real shoppers will abandon rather than solve a puzzle, especially on mobile, and the bots it’s meant to stop have gotten good at solving them anyway, either with cheap human click farms or with vision models.
The core trade-off
CAPTCHAs are a front-loaded cost: they interrupt everyone, up front, regardless of risk. That’s the opposite of how fraud is actually distributed. The overwhelming majority of sessions are legitimate, and only a small fraction need scrutiny.
A better shape for the decision
Invisible detection flips the trade-off. Instead of asking every visitor to prove they’re human, it silently gathers signal (device fingerprint, behavioral biometrics, IP reputation, automation markers) and only intervenes on sessions that actually look risky. Real shoppers never see anything. Automated or high-risk sessions get challenged or blocked.
This only works if the scoring happens fast enough (sub-second) and is explainable enough that a merchant can trust a “block” decision without babysitting it. Invisible by default, explainable when it acts: that combination is what separates modern bot detection from a CAPTCHA bolted onto checkout.