William Juan

I am a Frontend Developer working primarily in the web and hybrid mobile spaces. The majority of my work has revolved around the Angular ecosystem, including working with other Angular-related frameworks such as NativeScript and Ionic. My passion lies in converting a design into code and achieving a close to pixel-perfect end-product.

Frontend Developer

Improve the User Experience (UX) of an e-commerce application by implementing animations utilizing Angular animations, CSS animations, and Web Animation APIs.

Get Better Angular UX Using 4 Animation Techniques

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

MFA adoption urged to fight e-commerce fraud


Fraudulent purchases and data breaches are an incredibly costly problem for online retailers, and they are on the rise. A [ThreatMetrix report](https://www.signifyd.com/blog/2018/06/26/ecommerce-fraud-grow-threatmetrix/) found that in the first quarter of 2018, the growth of e-commerce fraud attempts outpaced the growth of overall e-commerce transactions by 83%.

According to the latest data from [IBM](https://digitalguardian.com/blog/whats-cost-data-breach-2019), the average cost of a data breach is currently $150 per compromised record, and the costs of data breaches will only increase with the passage of new privacy legislation.

For business leaders concerned about protecting profits and customer data from attacks the National Institute of Standards and Technology’s (NIST) [recent guidance for e-commerce businesses](https://www.nccoe.nist.gov/projects/use-cases/multifactor-authentication-ecommerce) to implement multi-factor authentication (MFA) can offer some relief.

<include src="TweetQuote" quoteText="According to the latest data from IBM, the average cost of a data breach is currently $150 per compromised record"/>

When deployed properly, MFA is one of the strongest defenses against fraudulent purchases and administrative data breaches, yet e-commerce has been [slow to adopt it](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf). [Experian’s research](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of businesses currently employ MFA, which they attribute to concerns about it negatively impacting customer experience.

Yet modern MFA solutions allow businesses to balance [security and convenience](https://auth0.com/blog/security-vs-convenience/). The NIST’s guidelines offer actionable advice for e-commerce to catch up to current security standards and what to look for when embracing MFA.

In this piece, we’ll go over what MFA is, how the NIST defines sound MFA solutions, and how e-commerce businesses can effectively implement MFA while balancing their other business needs.

## MFA in a Nutshell

In the simplest terms, [MFA](https://auth0.com/learn/get-started-with-mfa/) is a protocol for determining if individuals using your system are who they claim to be. MFA demands more than one (usually two) types of credentials:

* Something someone knows (like a password or their mother’s maiden name)
* Something they have (such as a phone on which they can receive a one-time SMS code)
* Something they are (biometric ID such as a fingerprint or facial scan)

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

A business using MFA can request additional verification at any point in a user’s session: login, purchase, or when navigating within a site or app.

Developers generally consider MFA to be the safest form of authentication, but there are a wide variety of MFA solutions available, and [they are not all created equally](https://auth0.com/blog/is-multifactor-authentication-the-best-way-to-secure-your-accounts-myths-and-reality/).

Finally, while most of us are familiar with MFA from our own online shopping experiences, it isn’t just for end users. The NIST emphasizes that requiring MFA for e-commerce admins is crucial for preventing data breaches rising from admin phishing attacks.

## Why E-Commerce Needs MFA

The continually-evolving digital threat landscape makes e-commerce businesses particularly vulnerable. As the NIST’s guide explains, 2015 saw the introduction of security improvements to credit cards and in-store terminals. These improvements reduced traditional credit card fraud but had the unintended effect of pushing more theft online.

E-commerce businesses are vulnerable to several types of attack, including [brute force attacks](https://www.scmagazineuk.com/brute-force-dictionary-attacks-400-percent-2017/article/1473168), [phishing](https://www.vadesecure.com/en/ecommerce-security-issues/), and [credential stuffing](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), which the NIST gives particular focus to in its guidelines.

In credential stuffing, user IDs and passwords stolen from one site are used to log in to another, preying on the tendency of users to recycle the same few passwords. Credential stuffing is arguably the [most dangerous and prevalent](https://blog.barracuda.com/2019/04/02/is-2019-the-year-credential-stuffing-dominates-the-threat-landscape/) security threat of 2019. An [Akamai report](https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf) found that retail was the single most vulnerable vertical for this attack, with over 10 billion credential abuse attempts in 2018.

<include src="TweetQuote" quoteText="Developers generally consider MFA to be the safest form of authentication"/>

Credential stuffing is difficult to combat, and will likely worsen as hackers develop more sophisticated bots that can combine data from multiple breaches in their attacks. Successful credential stuffing can lead to account takeover. For customers, account takeovers can result in fraudulent purchases being shipped to strangers.

For admins, they can lead to even [more serious data breaches](https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-and-lessons-learned/).

So how do you know if your current authentication system is at risk for these types of breaches? NIST lists the following common traits of vulnerable systems:

* Allow multiple incorrect logins without account lockouts
* Purchasers have reused the same password on multiple systems
* Accept weak passwords

If any of those describe your company’s authentication system, implementing MFA can quickly patch those leaks to project you and your customers while you strengthen your identity solution.

## What Makes a Good E-Commerce MFA Solution

MFA is open-source technology, but there’s a great deal of variance between implementation methods. NIST specifies a few “must-haves” for MFA solutions to protect your business effectively.

* **Customization**: Not every transaction should require additional authentication, so a good MFA solution allows you to tailor your system to your needs. NIST lists the most common parameters to trigger verification as cost threshold (a purchase above a certain dollar amount) and risk threshold. You can customize your definition of risk any number of ways, such as a customer using a new shipping address, paying with a new card, buying an item commonly associated with fraud, or making a purchase at an unusual time of day.
* **Require MFA for admin tasks**: A criminal with fraudulent admin credentials can do incalculable damage to your business, so NIST recommends that any administration activity requires verification.
* **Dashboards for suspicious activity**: The NIST report specifically mentions that e-commerce businesses should “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.” Auth0’s dashboard does just this: giving you a high-level look at your users, allowing your admins to spot patterns and being aware of new threats as they evolve.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

Auth0 also offers [breached password protection](https://auth0.com/docs/anomaly-detection), which tracks security breaches at third-party sites and flags potentially stolen credentials. Taken together, these features are a proactive way for e-commerce teams to detect and prevent fraudulent transactions.

## How an IDaaS Partner Manages Your MFA Needs

Many e-commerce executives have been slow to push for MFA because they feared alienating customers with irritating demands for credentials. However, online shoppers are increasingly reassured rather than irritated by such measures.

In [Experian’s 2018 Global Fraud and Identity Report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf), 66% of surveyed customers reported that they “like all the security protocols when I interact online because it makes me feel protected." Yet customer tolerance isn’t infinite, and in the same survey, a third of customers reported that security demands caused them to make fewer online purchases.

E-commerce businesses have to find an MFA solution that provides both effective fraud prevention and positive user experiences. By partnering with an identity management platform like Auth0, you can reap the benefits of increased security without taxing your developers or frustrating your customers.

* **Balance of ease and customizability**: Auth0’s MFA solutions can be turned on by flipping a single toggle, so you don’t have to wait weeks or months for your developers to secure your system. However, Auth0 also gives your team the freedom to write customized rules for MFA around any of the parameters discussed above.
* **Reduced friction for users**: Auth0’s MFA lets developers choose which factors for authentication suit their needs, whether that’s SMS, a token generator app, or Guardian, which lets users authenticate via a push notification.This allows users to utilize the MFA method they want while maintaining proper security practices.

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

Guardian doesn’t require your customers to install an app or even have a smartphone, so it’s a truly universal solution that meets both security and UX needs.

* **Evolves with and for you**: Keeping on top of current security standards can be a full-time job. But it’s not your full-time job, so outsourcing MFA to a highly respected and [accredited IDaaS partner](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) like Auth0 can provide peace of mind to your customers and yourself.

## NIST Guidance Can Offer Immediate Protection

Though NIST’s guidelines are voluntary suggestions, their very existence points to the urgent need for MFA adoption to protect online shopping as a whole. As the guide says: “fraud impacts the e-commerce ecosystem by decreasing purchaser confidence...and by increasing costs to offset the e-commerce fraud.”

Business leaders are under pressure to protect their customers from identity-based attacks without sacrificing revenue through excessive security measures. Finding this balance requires expert help, so reach out to an [Auth0 resource](mailto: sales@auth0.com) to talk about how you can put NIST advice into practice.

<include src="asides/AboutAuth0" />

---


Why NIST Recommends MFA to Fight E-Commerce Fraud

shafiq-shivji

Shafiq leads Product Marketing for Auth0's Ecosystem and Extensibility domains. He brings vast experience from previous roles as a Product Manager and Sales Engineer working in adjacent SaaS industries like machine learning, web/mobile apps, and communications. He especially enjoys the creative process of conceiving and taking high-impact products to market.

Product Marketing Manager

Shafiq Shivji

The right digital initiatives can turn your brick-and-mortar locations into your biggest assets against e-commerce competitors



It wasn’t long ago that showrooming — the tendency of customers to examine a product in a store and then go online to compare prices and make the actual purchase — was considered one of the four horsemen of the so-called retail apocalypse.

However, in recent years, savvy retailers have learned how to use showrooming to increase revenue. More and more [_success stories_](https://www.forbes.com/sites/forbesbusinessdevelopmentcouncil/2018/05/16/how-brick-and-mortar-stores-are-making-a-comeback-with-millennials-and-gen-zers/#54db375c1640) feature traditional retailers aligning their digital and brick-and-mortar operations, so each drives sales for the other. Instead of driving customers away, they’re building brand loyalty by creating tailor-made experiences online and in person.

Historically, retailers found showrooming so damaging and difficult to counteract because customers engaged in their browsing anonymously. Retailers had no way of understanding their customers’ behavior or of appealing to them once they left the store. This lack of shared customer data robbed retailers of the ability to leverage their unique advantages against e-commerce competitors. Now, however, more CTOs are recognizing that smart [_identity management_](https://auth0.com/retail/) is the key to keeping customers within the sales funnel, regardless of where they make a purchase. Below, we’ll discuss how to implement an approach to identity that helps your digital and physical stores feed into each other’s operations and drive revenue growth.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
 Security vs. customer experience has been a longstanding challenge in retail, but retailers no longer have to choose one over the other. <strong><a href="https://info.auth0.com/IdentityinRetailReport.html">Discover the intersection between CX and reliable security.</a></strong>
</div>

## Create a Single View of the Customer

If you want to turn showrooming to your advantage, you have to create a seamless customer experience across all touchpoints, thereby providing a more compelling, personalized environment than online price-shopping. Designing this experience first requires a comprehensive understanding of your customer.

Implementing [_social login_](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) across all your digital channels is a simple, efficient way to build a rich user profile. Social login confers several advantages, the first being that its simplicity increases the likelihood that customers will sign in since they don’t have to create a new set of credentials for your site.

Of course, customers who use social login then share a wealth of information about their attributes, interests, and location. Armed with this information, you can send more tailored and helpful recommendations their way—as well as guide customers back to your physical retail store. Social login is also crucial in creating the same experience across all digital touchpoints since their profile will be consistent regardless of where they sign in.

![Single view of the customer](https://images.ctfassets.net/23aumh6u8s0i/1Ro1NRBQRzpra6UhFFQDTR/74464aec53334c1931b02da0adbe4821/single-view-of-the-customer)

Building data-rich user profiles is only half the battle, though. That data can’t do anything to hang on to showrooming customers if it’s siloed on your digital storefront. To fully align your operations, it’s critical to integrate identity management with your existing CRM.

Auth0’s platform integrates with any CMS, analytics, or e-commerce platform, including [_Microsoft CRM_](https://auth0.com/docs/integrations/sso/dynamics-crm) and [_Salesforce_](https://auth0.com/docs/integrations/sso/salesforce). Integrating identity management with your existing SaaS tools enables you to share this single view of the customer with the systems that can put it to best use. For example, using [_geofencing_](https://www.salesforce.com/products/marketing-cloud/best-practices/geofencing-marketing/#) with your CRM can alert you to a customer browsing a store, with no need for login. Your sales team is now alerted and empowered by easy access to a customer’s profile. In some cases, you can even write a customized rule that if a customer enters and exits the store without purchasing, the CRM [_automatically alerts_](https://docs.microsoft.com/en-us/power-platform-release-plan/2019wave2/microsoft-flow/running-flows-geofence-generally) your digital marketing team to follow up with them.

The surgical precision of such a method is exactly the type of digital initiative that retail CTOs can get excited about; it’s not tech for tech’s sake, but a data-driven means of patching a revenue leak. Integrating customer data across channels is both cutting edge and a fairly simple way to streamline operations. When digital and physical stores share a rich and holistic view of the customer, it ensures that they are working collaboratively, not at cross-purposes.

## Introduce Endless-Aisle Technology

For a retailer, there’s nothing more disheartening than a customer who comes in search of a popular item, finds that it’s out of stock, and walks away saying, “I guess I’ll just order it on Amazon.” Endless aisle is the solution to this problem.

Endless aisle refers to the practice of providing customers with an in-store digital touchpoint from which they can order an unavailable product and have it shipped to their homes. Implementing endless aisle can be an effective method of wooing customers, even those who walked in only intending to showroom. For example, a touchscreen positioned next to a display can direct a customer to a “special release” version of the product available only through the retailer.

Endless-aisle tech also allows retailers to offer a wider variety of sizes, colors, or styles of any product, without the store having to stock them. It’s a way that CTOs can help achieve leaner inventory management without compromising on customer choice.

The possibilities expand further if you implement social login on your endless-aisle touchpoints since the reduced friction increases the likelihood that customers will actually use it to place an order. Auth0’s easy [_social login_](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) has been demonstrated to improve conversion rates and registration. When a customer logs in — even if they don’t make a purchase — you have a record of the interaction and can follow up with email and targeted ads.

Various retailers have experimented with different approaches to endless aisle, from installing kiosks to setting up tablets to using “beacons” in store aisles to send [_push notifications_](https://blog.getenjoyhq.com/the-3-golden-rules-of-push-notifications/) directly to a customer’s smartphone. Regardless of which solution makes the most sense for your business, Auth0’s platform is device-agnostic, so using identity to make a purchase is as easy in the store as it is on a mobile app or website.

<include src="TweetQuote" quoteText="Learn about endless-aisle technology and how it can help you woo customers."/>

## Use Customer Data to Facilitate Reverse Showrooming

To fully seize on the revenue-driving potential of showrooming, you shouldn’t treat it as a one-way street, steering customers from brick-and-mortar locations to digital stores. Instead, you can use effective identity management to create a cyclical relationship between touchpoints, playing to the individual strengths of each.

Using your digital presence to encourage customers to show up in person is a phenomenon known as webrooming, or “[_reverse showrooming_](https://www.fool.com/investing/2019/03/19/call-it-reverse-showrooming-these-companies-are-ca.aspx).” With your single view of customer identity, you can send personalized email reminders, offers, and targeted ads to drive shoppers to stores.

Certain types of retailers are particularly well-positioned to capitalize on webrooming because their products all but require customers to try them on or sample them in person. [_Ulta Beauty_](https://www.fool.com/earnings/call-transcripts/2019/03/15/ulta-beauty-ulta-q4-2018-earnings-conference-call.aspx), for example, credited its in-store sales increase to “incorporating relevant product recommendations and replenishment reminders across digital channels” in what it called a “reverse channel shift.”

Customer data can also drive revenue and cut costs in ways that go beyond traditional marketing initiatives, as in the case of returns. A [_2018 CBRE report_](https://www.supplychain247.com/article/holiday_season_heightens_challenges_of_online_returns) found that returns comprise 8% of sales for brick-and-mortar retailers, while online shoppers return goods at levels from 15% to 30%. But with effective identity management, you can turn this behavior to your benefit. With well-organized, accessible data, you can direct customers to their local store to return the product they bought online. Not only does this allow for immediate restocking and save on shipping costs, but it also gives you a chance to make another sale once the customer is in the building. It’s just one example of the many creative, often overlooked, yet valuable ways a robust identity management system can allow CTOs to directly contribute to cost savings.

<include src="TweetQuote" quoteText="Learn how webrooming uses your digital presence to encourage customers to show up in person to your store."/>

## You Can Turn Showrooming from a Problem into a Solution

As long as you’re keeping customers in your sales funnel, and not losing them to the competition, showrooming can deliver some surprising benefits. For example, when a customer tries on a pair of shoes in the store but purchases them online, they’re far less likely to order the wrong size and put the retailer through an expensive returns process. However, unless your physical and digital channels are fully integrated, you’d have no way of knowing the important role your store played in that transaction, so you might mistakenly conclude that the store isn’t contributing to sales.

Once you have an identity management system in place that de-siloes your customer data, you can ensure that just because a customer walks out the door, you haven’t lost the chance to make a sale. If you’re in search of digital initiatives that directly address business needs, partnering with an identity management platform like Auth0 is an easy way to turn a loss into a win. Reach out to an [_Auth0 resource_](mailto:%20sales@auth0.com) for customized insight.

<include src="asides/AboutAuth0" />


How to Leverage Showrooming Behavior to Increase Revenue

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how a B2C Company implemented Single Sign-On to provide seamless integration between different e-commerce portals.

"e-commerce"