alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Stacking integrations from the Auth0 Marketplace enables custom identity use cases with no-code ease

As they compete for attention and conversions in a crowded global marketplace, online retailers and eCommerce companies face a number of challenges. For example:

* **Customers expect personalized omnichannel experiences** at every stage of the buying journey
* **Users want to engage with their apps or services at any time, from any device, in a secure and safe manner** — and they don’t want to spend time with cumbersome account creation
* **The loss of the third-party cookie and tighter app restrictions are threatening marketing strategies** that rely upon cookies and app-based tracking and are forcing a larger dependence on first-party data

The brands that will not only survive but thrive in this dynamic environment will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

But with a developer team that’s busy enough already, it’s important for the business (and for developer sanity) to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

## Identity Enables Online Retail and eCommerce

Identity may not be top of mind for retailers, but the identity function is essential to helping eCommerce companies:

* **Maximize conversions and revenue** by[ minimizing friction in any and every customer interaction](https://auth0.com/resources/whitepapers/identity-insights-101)
* **Meet user expectations** by[ powering personalized experiences](https://auth0.com/case-studies/coles-group)
* **Manage risk** by addressing regulatory requirements and privacy laws and by addressing[ identity-specific security threats](https://auth0.com/resources/whitepapers/state-of-security-identity-report)

A customer identity and access management (CIAM) solution with the right set of out-of-the-box features can help engineering teams to avoid a whole lot of pain and expense.

For example,[ CIAM has been a core enabler of cosmetic giant Lush’s consumer-oriented initiatives](https://auth0.com/case-studies/lush-cs), powering a range of features including single sign-on (SSO) and guest checkout, as well as the centralization of the point-of-sale (POS) system for the entire business. In particular, extensive out-of-the-box functionality allowed Lush to implement these features with a limited developer team while ensuring the pace of transformation didn’t compromise customer privacy or system security.

While out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who’s ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/16QlWAA6ZN2lnMATb3RbMu/3e305e33068ab6a5afb1419500972b4c/Marketplace_Partner_Spotlight_Separator_V01B_3x.png)

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle the identity basics (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third parties to execute complex conditional flows.

Building such advanced logic from scratch is a major undertaking requiring specific skill sets, tools, and knowledge; worse still, it’s inefficient because each use case is a custom coding exercise with little that can be reused.

Alternatively, having a simple but effective (read: powerful, flexible, efficient, etc.) way to make identity work with your other business systems allows developers to quickly implement customized identity solutions without the time, expense, and headaches associated with custom coding projects… and that’s where[ extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020,[ the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) makes it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even ‘stack’ these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let’s look at some examples…

## Prevent Fraudulent Registrations

One of the major objectives for consumer-facing companies is to convert prospects into first-time customers, and this makes fraudulent registrations (or signup fraud) especially problematic because:

* [Leveraging a customer data platform (CDP)](https://auth0.com/blog/why-you-should-integrate-customer-identity-and-your-customer-data-platform/), customer flows are often optimized based upon data that shows how users interact with a user interface and ultimately ‘convert’ — but fraudulent registrations pollute this data, significantly complicating business analytics activities.
* To maximize conversions, consumer businesses especially must minimize friction during the registration process — but lowering barriers for legitimate users also lowers the barriers for abusers.

While authentication (e.g., logging in with a username and password) shows that a user has the credentials that correspond to a particular account, it doesn’t prove that the user is who they say they are — that’s where[ identity proofing](https://auth0.com/blog/what-is-identity-proofing-and-why-does-it-matter/) comes in, by using additional verifications to create a high degree of confidence that your users are who they claim to be.

Here’s how a sign-up flow works when identity proofing is integrated:

* A new user clicks “sign up” on your website
* The sign-up flow calls upon[ the identity-proofing solution](https://marketplace.auth0.com/categories/identity-proofing)
* The identity proofing solution verifies the user’s identity using phone carrier verification
* Customer identity data is captured and collected by the[ CDP](https://marketplace.auth0.com/integrations/tealium)

By making signup fraud much more challenging to commit, identity proofing meaningfully alters the economics for bad actors and, in doing so, protects your customers, your reputation, and the integrity of the data stored in your CDP.

## Protect and Enrich Existing User Accounts

In addition to protecting against signup fraud, incorporating identity proofing into user workflows can also protect against account takeovers (ATO) and enrich user profiles with ‘golden data’ like age and demographic information.

For example:

* A returning user performs some action, like logging in or attempting to update account details
* Due to the perceived risk associated with the action (and perhaps incorporating other risk signals), the identity stack calls upon the identity-proofing solution as a safeguard
* The identity proofing solution validates the user’s identity, ensuring that the activity is not from a bad actor attempting to take over the account; or, if the user is accessing the service via a mobile app, a[ mobile verification integration](https://marketplace.auth0.com/integrations/incognia-authentication) validates the device ID to confirm the user’s identity
* With the user’s identity validated, the action is permitted, and the data associated with the user’s activity is sent to[ the CDP](https://marketplace.auth0.com/integrations/tealium) to build out the profile

Depending upon the risk signals or significance of the action, the identity-proofing solution may employ document scanning (e.g., passport, driver’s license) and cross-validation as the verification mechanism. When this is the case, the CDP can be enriched with information that may not yet be a part of the user’s profile.

![Auth0 Marketplace](https://images.ctfassets.net/23aumh6u8s0i/6U3nuyVYlbcg9i0C36khkU/61a068d638a5ee2753facbcf5924e55c/Marketplace_Partner_Spotlight_Separator_V01A_3x.png)

## Stop Fraudulent Checkouts

The previous examples involve sending data to the CDP, but the CDP data can also be leveraged within the identity flows. For instance, here’s how data from a CDP can combine with an identity-proofing solution to stop a fraudulent checkout:

* A threat actor masquerading as a user logs in, browses products and adds items to the cart
* The CDP collects and stores behavioral data from this session. The data can then be used to help determine that the risk threshold is exceeded — e.g., the total purchase amount exceeds the real customer’s typical habits, or the IP geo-location is outside the real customer’s region, etc.
* The threat actor fails the identity proofing verification, and the purchase is stopped, protecting the customer and the retail brand from the effects of fraudulent purchases

## Reward Your Loyal Customers

Retail brands can suffer reputational harm when resellers buy premium products (e.g., sneaker drops, limited edition collaborations, small batch cosmetics, etc.) only to mark up the price on a third-party marketplace.

By restricting who is able to purchase these products, retailers can reward loyal customers and protect their brand:

* A user logs in
* The CDP provides customer data that can then be used to indicate whether or not the user exceeds a certain ‘loyalty’ threshold (e.g., based on purchase history)
* If a user exceeds the threshold, then the site/service shows them premium offers
* The user adds a premium product to their cart and initiates the checkout
* Identity proofing validates the user’s identity to guard against an account takeover and ensure that the purchaser is a loyal customer

Additionally, the same building blocks can be used to encourage preferred channel adoption. For example, many retailers reserve limited edition products only for users of their mobile app. Web users could be presented with a message saying, “To see promotional offers, please switch to the app.” If the user’s device has already been verified in a past interaction, then the purchase can proceed; otherwise, the identity stack calls a short verification flow. 

Customer lifetime value is rooted in personalized offers, promotions, and pricing, which depend on rich customer profiles stored in CDPs. To build these profiles, brands collect customer data across various channels and systems, with the mobile app being perhaps the most valuable channel.

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle.[ Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

We’re excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of[ Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within[ the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Why Easy Extensibility is an Online Retail Essential

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to decrease abandoned carts by improving the simplicity and security of your user login process.

When consumers create e-commerce accounts, retailers can use their purchasing history to offer a more personalized shopping experience, which can boost [retail conversion rates](https://www.mckinsey.com/industries/retail/our-insights/personalizing-the-customer-experience-driving-differentiation-in-retail) by up to 15%. However, it is tough for retailers to convince people to actually sign up — case in point, [a 2021 DMI survey](https://baymard.com/lists/cart-abandonment-rate) found that 24% of U.S. shoppers abandoned an order just because they were asked to make an account.

We [surveyed](https://images.ctfassets.net/2ntc334xpx65/7o4UAUaHOMHJeV5fmgK9S1/b4c300762c64becf6cef5989046aaf8f/Infograph_2_2x.jpg) over 8,000 consumers across six global markets (the UK, France, Germany, Australia, Singapore, and Japan) to learn about the login experience they preferred and discovered widespread frustration with standard username/password (UP) login methods and businesses that fail to meet their ease-of-login expectations.

Our survey found five problems that stop consumers from signing up for an online account:

1. Completing long login or sign-up forms (49%)
2. Meeting minimum password requirements (47%)
3. Entering private information (46%)
4. Creating a new ID and password for every app or online service (43%)
5. Verifying their account with one-time passwords (OTP) (23%)

 
Such frustrations lead to some of the worst security hygiene offenses, in particular, reuse of passwords across multiple accounts. Our survey found that 85% of international consumers reuse passwords, with 41% of them doing so “frequently or all the time” and 29% “sometimes”.

We asked consumers about the kind of login experience that would increase their chances of signing up for an account and found that adding certain authentication features would actually encourage them to do so. Our survey results indicated that, when available, consumers are more likely to complete the signup process if given more secure and easy-to-use login experiences.

![Authentication 01](https://images.ctfassets.net/23aumh6u8s0i/24uCeR7yhZbNmMpbFE7v3v/c2245aa707cc9d83b5242357ed06ac39/Passwordless-Authentication-sep1.jpg)

Below are four authentication tools that can improve your retail conversion rate by creating a more streamlined, secure login experience that satisfies users.

## 1. Multi-factor Authentication (MFA)

[MFA](https://auth0.com/learn/get-started-with-mfa/) requires users to verify their identity in more than one way, which helps reduce the potential for unauthorized access to their data. For instance, a user may submit a password and then have to additionally verify a secondary account or device they own using a link sent to their email address or phone.

Consumers want to know that companies are protecting their data. In a 2020 survey with 1,000 North American consumers asked about privacy and data collection, management consulting firm McKinsey & Company found that [87% of respondents said](https://www.mckinsey.com/business-functions/risk-and-resilience/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative) they “would not do business with a company if they had concerns about its security practices.” MFA helps retailers provide consumers with greater confidence their data is protected because it blocks [99.9% of attacks](https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/).

While 49% of our surveyed consumers noted they were more likely to sign up for an online account if a business offered MFA, only 28% of surveyed businesses currently offered it as part of their login process. This discrepancy arises from the perception that the multiple steps in MFA mean extra hassle for both users and the business.

However, MFA is actually fairly easy to implement — many companies [quickly adopted it](https://www.brighttalk.com/webcast/15793/483340/451-research-report-remote-work-during-covid-19-drives-mfa-adoption) when COVID-19 forced them to pivot to a remote workforce in 2020.

**Company use example**: According to [Jordan Christensen](https://auth0.com/case-studies/ecobee/), VP of Technology at [ecobee](https://www.ecobee.com/en-us/), the smart device retailer wanted to protect consumers using ecobee’s home monitoring products, so they outsourced MFA implementation. His team was thrilled they were able to bring MFA to customers “without needing to reinvent the wheel.”

## 2. Biometrics

[Biometrics](https://auth0.com/blog/what-are-biometrics-the-proscons-of-biometric-security/) uses measurable human traits, characteristics, or behaviors to confirm user identity. Fingerprint scans and facial recognition are two of the most common forms of biometrics, but there’s a growing list that includes options like voice, gait, and even DNA recognition.

Biometric traits are harder for hackers to fake than usernames and passwords, so they can help mitigate security concerns that could keep consumers from signing up. [Consumers](https://usa.visa.com/visa-everywhere/security/how-fingerprint-authentication-works.html) also like it because it’s faster than username/password authentication, and they don’t have to struggle with remembering login credentials.

While 46% of our surveyed consumers responded that they’d be more likely to log in if they could use biometrics, only 21% of the businesses we surveyed currently offered it — the biggest consumer-business gap we found in the study. Taking steps to close the gap between consumer expectations and current business practices will result in a better customer experience and better retail conversion rates.

Steven Rees-Pullman, SVP, International at Auth0, explains that it can be a [“heavy lift”](https://auth0.com/blog/businesses-fall-short-of-consumer-expectations-for-login-experiences-auth0-survey-reveals/) for businesses to develop biometric authentication in-house due to factors like limited bandwidth of IT employees or a lack of expertise with the process. To prevent diverting company resources and adding additional stress on already busy IT teams, some companies are instead choosing to outsource implementation to third-party providers that specialize in identity management and already have [experience with biometrics](https://auth0.com/docs/mfa/configure-webauthn-device-biometrics-for-mfa).

**Company use example**: Consumer use of [Microsoft’s](https://www.microsoft.com/) biometric authentication tool Windows Hello, which lets users log in with a face, iris, or fingerprint scan instead of a password, jumped from [69.4% to 84.7%](https://www.microsoft.com/security/blog/2020/12/17/a-breakthrough-year-for-passwordless-technology/) in 2019 alone. Additionally, [Disney](https://www.disney.com/) started experimenting with a [facial recognition system](https://insidethemagic.net/2021/04/disney-world-facial-recognition-ks1/) at Walt Disney World’s Magic Kingdom theme park this year and was using [fingerprint scanning](https://insidethemagic.net/2020/10/disney-fingerprint-scanning-kj1/) to prevent ticket fraud before COVID-19 hit.

## 3. Social Logins

[Social logins](https://auth0.com/learn/social-login/) use existing login information from a social network provider that allows consumers to access a third-party website account without having to create another one. While the number of social providers [keeps growing](https://www.theverge.com/2021/5/7/22422980/tiktok-log-in-sound-kit-app-integration-developers), staple networks include Facebook, Google, and Twitter.

Consumers prefer social logins to traditional UP authentication because they typically allow them to create and log in to accounts with just one click. As a result, social logins generally [boost conversion rates](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) by up to 20% — though some companies report seeing [as high as 40%](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates). Social logins also provide access to rich user data, allowing you to use more customized, targeted marketing with individual consumers.

Our survey found there wasn’t a huge gap between consumers and businesses with social logins, with 37% of consumers noting they were more likely to sign up with it and 31% of businesses currently offering it.

Social logins are typically connected to larger companies with established data privacy measures, but security can be compromised if users are reusing passwords. Martin Gontovnikas, former VP of Marketing at Auth0, says consumers using social logins should [vary their passwords across platforms](https://auth0.com/blog/social-login-on-the-rise/), and you can choose to boost the security strength of social logins by combining it with MFA.

**Company use example:** Kevin Ho, VP of Marketing for marketing agency [WishPond](https://www.wishpond.com/), found that after featuring a social login option more prominently than UP authentication, the company saw an [8.5% increase](https://blog.wishpond.com/post/115675436270/how-we-improved-sign-up-rates-by-8-5-with-this-simple-test) in their conversions.

## 4. Passwordless

[Passwordless](https://assets.ctfassets.net/2ntc334xpx65/3Ew2LXo2UJDQdlSukeQxwq/de57802e6a5da4a58de15ee68b42ccf5/Passwordless-Whitepaper-Auth0.pdf) authentication is exactly what it sounds like: confirming a consumer’s identity with something different from a password. Outside of biometrics, typical passwordless options include magic links, where a user is sent a link to log in after submitting their email, one-time codes, and push notifications.

With the average consumer having [approximately 100 passwords](https://tech.co/news/average-person-100-passwords#:~:text=According%20to%20new%20research%20from,has%20100%20passwords%20to%20remember!), passwordless authentication reduces potential user frustration with logins. Not having traditional UP authentication also means increased data security, with Verizon noting in its [2021 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) that stolen login credentials are the main way organizations get hacked. Next Move Strategy Consulting published a report [this month](https://www.nextmsc.com/report/passwordless-authentication-market) predicting that the global passwordless authentication market will grow by 29.1% by 2030.

Even so, passwordless authentication came in last in our survey in terms of both consumer likelihood to sign up with it (34%) and business use (20%). Traditionally, [IT infrastructure](https://www.forbes.com/sites/forbestechcouncil/2021/04/20/why-is-passwordless-authentication-met-with-reluctance/?sh=5a946c366d06) at large companies has been set up for UP authentication, so it can be a complex process for businesses to implement passwordless tech on a wide scale.

According to Cybersecurity Insiders’ 2021 [“The State of Passwordless Authentication”](https://media.fidoalliance.org/wp-content/uploads/2021/03/The_State_Of_Passwordless_Authentication_2021_Report.pdf) report, many organizations that have chosen to implement passwordless authentication have done so because of its proven security, ease of use, and ability to “help consumer-facing businesses increase revenue.” Microsoft also reported that [more than 150 million users](https://www.microsoft.com/security/blog/2020/12/17/a-breakthrough-year-for-passwordless-technology/) were using passwordless authentication on Windows in May 2020.

**Company use example:** Kunal Chakraborty, Global Vice President for Customer Experience and Digital at [GrandVision](https://www.grandvision.com/), the optical retailer, said the company made [“the checkout process as customer-friendly as possible”](https://auth0.com/case-studies/grandvision/) by having a third-party provider implement passwordless authentication — accounts are created just by clicking a box. As a result, GrandVision saw a [boost in their conversions by up to 54%](https://techbeacon.com/security/your-passwordless-future-make-it-sooner-rather-later).

![Authentication 02](https://images.ctfassets.net/23aumh6u8s0i/3DuYOoznWG10geDOeYwBVm/02b5dbc23075eebf4d984f22dbaaec76/Passwordless-Authentication-sep2.jpg)

## Authentication Technologies Enhance User Experience

While it may seem like adding a new element to your login box would drive consumers away, it’s actually the opposite. By using one of the authentication tools above to provide consumers with a simple, secure login experience, you can satisfy users and continue to strengthen their ties to your brand with personalized marketing — strengthening your retail conversion rate in the process.

Auth0 makes implementing the authentication technologies above simple — learn more [about Auth0’s platform](https://auth0.com/authentication) here.

4 Authentication Tools That Increase Retail Conversion Rates

The new updates offer some reversals and clarifications worth paying attention to.

<div class="alert alert-info alert-icon">
 
 What are the NIST Password Guidelines? 
 The NIST Password Guidelines are also known as <a href="https://pages.nist.gov/800-63-3/sp800-63-3.html">NIST Special Publication 800-63B</a> and are part of the NIST’s digital identity guidelines. They were originally published in 2017 and most recently updated in March of 2020 under” Revision 3 “or” SP800-63B-3. They are considered the most influential standard for password creation and use policies by many <a href="http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf"> password cracking experts</a>. 
</div>

According to the Verizon Data Breach Investigations Report, compromised passwords are responsible for [81% of hacking-related breaches](https://enterprise.verizon.com/resources/reports/dbir/). Needless to say, a key part of overall information security is securing your users’ passwords.

However, while there are a lot of conventional password security practices that seem intuitive, a lot of them are misleading, outdated, and even counterproductive.

That’s where the National Institute of Standards and Technology (NIST) password guidelines (also known as [NIST Special Publication 800-63B](https://pages.nist.gov/800-63-3/sp800-63-3.html)) come in. Although they’re required only for federal agencies, they’re considered the gold standard for password security by [many experts](http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf) because of how well researched, vetted, and widely applicable they are for the private sector.

In fact, many [corporate security teams are already using the NIST password guidelines](https://venturebeat.com/2017/04/18/new-password-guidelines-say-everything-we-thought-about-passwords-is-wrong/) as a baseline to provide something even more powerful than policies: credibility. So if you’re looking for what actually works for password security in 2020, here’s what the NIST says you should be doing (in plain English).

## New Password Creation Guidelines

Password security starts with the physical creation of that password. However, it’s not just your users’ responsibility to ensure their passwords are up to par &mdash; it’s also up to you to ensure that the passwords are strong enough (especially in light of how [the FTC handled the TaxSlayer case](https://biglawbusiness.com/cybersecurity-enforcers-wake-up-to-unauthorized-computer-access-via-credential-stuffing/)).

Here’s what the NIST guidelines say you should include in your new password policy.

### 1. Length > Complexity

Conventional wisdom says that a complex password is more secure. But in reality, password length is a much more important factor because a longer password is harder to decrypt if stolen.

Here’s a great example of how password length benefits you more than complexity on a technical level:

![Complexity of Passwords](https://images.ctfassets.net/23aumh6u8s0i/7zLMdDrj4rEC2IBL5BR2sN/cfc2a70bfbf520f7b439685894975a6c/passwords)
This is why the NIST guidelines call for a strict eight-character minimum length.

However, additional research shows that requiring new passwords to include a certain amount of complexity can actually make them less secure. And that’s why NIST has also removed all password-complexity requirements from their guidelines.

For example, many companies require that users include special characters, like a number, symbol, or uppercase letter, in their passwords to make them harder to decrypt. 

Unfortunately, many users will add complexity to their password by simply capitalizing the first letter of their password or adding a “1” or “!” to the end. And while it technically does make a password more difficult to crack, most password-crackers worth their salt know users tend to follow these patterns and can use them to reduce the time needed to decrypt a stolen password. 

Additionally, as password complexity increases, users tend to reuse passwords from account to account, increasing the risk that they could be the victim of a [credential stuffing attack](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/) if one account is breached. 

So instead of forcing users to create more complex passwords, ask them to create longer ones if you want to improve password security.

### 2. Eliminate Periodic Resets

Many companies ask their users to reset their passwords every few months, thinking that any unauthorized person who obtained a user’s password will soon be locked out. However, frequent password changes can actually make security worse.

It’s difficult enough to remember one good password a year. And since users often have numerous passwords to remember already, they often resort to [changing their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die), such as adding a single character to the end of their last password or replacing a letter with a symbol that looks like it (such as $ instead of S).

So if an attacker already knows a user’s previous password, it won’t be difficult to crack the new one. The NIST guidelines state that periodic password-change requirements should be removed for this reason.

## Password Authentication Guidelines

The way you authenticate a password when a user logs in can have a massive impact on everything related to password security (including password creation). Here is what NIST recommends regarding the actual input and verification of passwords.

### 1. Enable “Show Password While Typing”

Typos are common when entering passwords, and when characters turn into dots as soon as they’re typed, it’s difficult to tell where you went wrong. This motivates users to pick shorter passwords that they’re less likely to mess up, especially on sites that allow only a few login attempts.

So if a user can choose, when alone, to have the password displayed during typing, they have a much better shot at entering lengthy passwords correctly on the first try.

### 2. Allow Password “Paste-In”

If passwords are easier to enter, your users are more likely to use a longer, more complex password in the first place (which is more secure). That’s where “paste-in” password functionality is now advantageous &mdash; if entering passwords is as simple as copying and pasting them into a password field; it encourages safer behavior.

This is especially important considering how many passwords the average person has to remember these days and the tools people are using to manage them all.

For example, a [survey by NordPass](https://nordpass.com/blog/password-habits-statistics/) found that 70% of people in the United States and the United Kingdom have more than ten passwords (20% have over 50). And many people have started using password managers to generate and store their passwords. So by allowing paste-in functionality this also allows people to use the auto-fill function of password managers to streamline the authentication process and stay safe at the same time.

### 3. Use Breached Password Protection

The new NIST password guidelines require that every new password be checked against a “blacklist” that includes dictionary words, repetitive or sequential strings, passwords taken in prior security breaches, variations on the site name, commonly used passphrases, or other words and patterns that cybercriminals are likely to guess.

Some [platforms, like Auth0](https://auth0.com/breached-passwords/), take this to another level and check real-time login attempts against a blacklist, ensuring that users are protected even if their passwords are leaked publicly:

<include src="Vidyard" id="fCqj5aaDQT6DgL55yYqczd" />

### 4. Don’t Use “Password Hints”

Some companies try to help users remember complex passwords by offering a hint or requiring them to answer a personal question.

However, with the constant dissemination of personal information on social media or through social engineering, the answers to these prompts are easy to find, making it easy for attackers to breach your user’s accounts. So this practice is now forbidden by the NIST guidelines.

### 5. Limit Password Attempts

Many attackers will attempt to breach an account by logging in over and over again until they figure out the right password (brute-force attack). And a great way to stop these kinds of attacks is to limit the number of login attempts that are allowed before locking the account.

The average attacker will need a lot more attempts than the average typo-prone user. So by including a cutoff or delay, you’ll drastically increase the amount of time an attacker will need to break in (to the point where it’s almost pointless to try).

### 6. Use Multi-Factor Authentication

[Multi-factor authentication](https://auth0.com/multifactor-authentication/) (MFA), also known as two-factor authentication (2FA), requires that users demonstrate at least two of the following in order to log in:

1. “something you know” (like a password)
2. “something you have” (like a phone)
3. “something you are” (like a fingerprint)

**The NIST guidelines now require the use of multi-factor authentication for securing any personal information available online**. However, their guidelines are very specific on what qualifies as a valid form of authentication and what does not.

For example, in the new guidelines, email joins voice-over-internet protocol (VoIP) on NIST’s list of channels that are not acceptable for MFA because they’re not considered out-of-band (OOB) authenticators (they’re not truly a “separate channel” because they do not necessarily prove possession of a second device).

So even if you’re using two-factor authentication, you’ll want to review the NIST guidelines to ensure that the channels you’re using meet NIST standards.

### The SMS Controversy

A previous version of the NIST password guidelines stated that using SMS as a second channel for authentication may not meet OOB requirements and could be disallowed in the future.

This led to a deluge of articles released by the security world declaring the death of SMS-based 2FA. However, the next revision of the NIST guidelines contained no explicit mention of SMS deprecation, leading to confusion.

![Nist guidelines](https://images.ctfassets.net/23aumh6u8s0i/2STV4YKmHKKMmB4xtRBt5u/c478850d37b6aa648fa5bdf87faed42e/sms-controversy)

After [lobbying from the CTIA](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/), NIST backtracked on its concerns, explicitly including SMS as a valid channel for OOB authentication.

Nevertheless, some concerns about SMS authentication remain valid. [SMS channels can be attacked](https://auth0.com/blog/what-the-new-nist-guidelines-mean-for-authentication/) by smartphone malware and SS7 hacks. In addition, message forwarding and number changes mean that access to messages does not always prove possession of a device.

NIST has not ignored this uncertainty. Their guidelines do insist that authenticators make sure the user’s telephone number is associated with a specific physical device when SMS (or voice) 2FA is used. They further recommend that authenticators watch for behavior such as device swapping, SIM changes, and number porting, which could indicate a compromised channel.

However, the removal of recommendations against SMS indicates that this [widely used 2FA channel is far from dead](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/). It remains much more secure than email and is an effective way to reduce your reliance on passwords.

## Password Storage Guidelines

Many security attacks have nothing to do with weak passwords and everything to do with the authenticator’s storage of passwords. Here’s what NIST recommends for ensuring passwords are stored securely.

### 1. Secure Your Databases

Your users’ passwords will be stored in a database (or several). So, to protect them, it’s important that access to these databases is limited to essential personnel only.

However, most companies’ databases aren’t as secure as you’d expect.

“The big thing that bothers me is when I go to a customer’s site. Usually, their [database] configuration is so weak that it’s easy to exploit. You usually don’t need buffer overflow or SQL injection [attacks] because the initial setup of the database is totally insecure,” Slavik Markovich, CTO of Sentrigo, told [Dark Reading](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481).

So to ensure that your users’ passwords are stored safely, you’ll want to ensure that your databases are secured from the [most common attacks](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481) at all times.

Additionally, keep in mind that any authentication credentials your administrators use should follow the NIST guidelines as well since that’s how attackers often gain access.

### 2. Hash Users’ Passwords

Password database breaches are going to happen. However, you can still protect your users in the event they do by hashing their passwords before you store them. For example, [Patreon’s](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/) databases were breached in 2015. But thanks to a strong hashing scheme (bcrypt), the attackers were unable to use the credentials they acquired because they couldn’t revert the password hashes to the original passwords.

The NIST guidelines require that passwords be salted with at least 32 bits of data and hashed with a one-way key derivation function such as Password-Based Key Derivation Function 2 (PBKDF2) or Balloon. The function should be iterated as much as possible (at least 10,000 times) without harming server performance.

In addition, they recommend an additional hash with a salt stored separately from the hashed password. That way, even if the hashed passwords are stolen, brute-force attacks would prove impractical.

## Focus on User Experience to Improve Password Security

Cybersecurity and user experience are often at odds with each other. But the NIST password guidelines are pretty clear: strong password security is rooted in a streamlined user experience.

Your users will always do what makes their lives easiest (and [research shows](https://www.darkreading.com/informationweek-home/password-reuse-abounds-new-survey-shows/d/d-id/1331689) they’ll do so even if they know that behavior compromises their password security). So if you create the kind of user experience that uses this tendency to encourage safe behavior, it helps you both keep their data secure.

_Want to learn more about finding the magical balance between UX and security? [Check out this blog post that lays out our philosophy](https://auth0.com/blog/balancing-ux-and-security-at-auth0/)._

NIST Password Guidelines and Best Practices for 2020

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Retailers are embracing eCommerce but are vulnerable to fraudsters impersonating real users.

Holiday shopping looks a lot different this year. As a result of the pandemic, shoppers are avoiding brick-and-mortar stores and ordering online, with [eCommerce sales up 37%](https://www.digitalcommerce360.com/article/quarterly-online-sales/) over 2019. Unfortunately, the eCommerce boom has created a similar spike in eCommerce fraud. [One study found](https://www.digitalcommerce360.com/2020/07/27/the-cost-of-fraud-is-up-7-for-us-merchants/) that in 2020, mid-sized to large merchants experienced 14% more fraudulent transactions per month than the year before.

These dueling forces put retailers in a difficult position: they need to provide eCommerce options to customers without exposing themselves to attack. Retailers can balance these needs by putting strong fraud-prevention tools in place to maximize their eCommerce trade while locking out fraudsters.

## Bot-Based Fraud Is Rampant in Ecommerce 

Retailers trying to guard against cybersecurity threats must first understand what those threats are. This list is constantly evolving, and in 2020, while there are several types of attacks, most of them use armies of automated bots.

In a [2020 survey](https://kount.com/wp-content/uploads/2020/10/Bot-Landscape-and-Impact-Report-2020-Kount.pdf) from cybersecurity company Kount, 81% of businesses reported that they dealt with malicious bots often or very often, and 25% reported that a malicious bot attack cost their organization over $500,000.

Bot attacks on retailers can take multiple forms. In one variation, armies of bots buy up all the inventory for in-demand items for later resale at a markup. For years, that’s been a popular trick for coveted concert tickets and sneakers, but it’s equally effective for hot-ticket gift items. The risk for retailers is that customers will come to your site looking for a product, and when you don’t have it, they’ll switch to your competitors.

Many bot attacks use identity as their vector, meaning they break in through the login box by impersonating legitimate users. [In credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) attacks, hackers take user login credentials that were stolen in one data breach and use them to break into other sites. Credential stuffing attacks have become much more widespread in recent years because people tend to reuse passwords, and [billions](https://www.wired.com/story/collection-leak-usernames-passwords-billions/) of these stolen credentials are currently circulating on the dark web.

Ecommerce retailers are at particular risk of these attacks, especially with the booming popularity of “buy online, pick up in store” (BOPIS). In the past, fraudsters had to get stolen merchandise mailed to them, increasing the likelihood that the transaction would be stopped or they would be caught. But with curbside delivery, they can order goods and pick them up before anyone catches on.

Even if bot attacks aren’t successful in conducting fraudulent transactions, they can still crash your website by flooding it with requests. [Auth0’s research](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) has found that in a credential stuffing attack, a site’s traffic can spike by as much as 180-fold.

![Critical Tools in the Fight Against Ecommerce Fraud](https://images.ctfassets.net/23aumh6u8s0i/5CBZ47YCilUVHG1F0gf9om/a5893de32934cc5d60a561a9282d2217/prevent-ecommerce-fraud-separator)

## Critical Tools in the Fight Against Ecommerce Fraud

Fortunately for retailers, there are effective methods to deter bots without creating unnecessary obstacles for legitimate users. Since most eCommerce fraud takes the form of [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) &mdash; meaning that fraudsters impersonate legitimate users&mdash;the fixes all relate to being able to more accurately verify user identities.

### MFA

[Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) demands that users prove they are who they claim to be by providing an additional form of verification beyond the classic username-password combination. Common MFA methods include one-time codes sent to a user’s email address and [biometric scans](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/), such as fingerprints. While MFA is the single most reliable defense against identity-/authentication-based attacks, it is not a silver bullet. If retailers want to defend against automated attacks, they have to think about security in layers. 

In 2019, [NIST started recommending](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that retailers implement MFA to fight eCommerce fraud, but adoption has still been slow. That’s partly because retailers worry that MFA will introduce too much friction and will make customers abandon their carts. [But MFA standards are constantly evolving to be more seamless and secure](https://auth0.com/blog/auth0-introduces-adaptive-mfa). For instance, [Microsoft recently told](https://www.zdnet.com/article/microsoft-urges-users-to-stop-using-phone-based-multi-factor-authentication/) its customers not to use SMS as an MFA delivery mechanism because cell phone lines are vulnerable to multiple forms of attack. (They recommend [hardware keys as the least susceptible to attack](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/).)

### Attack Protection

You want to find out about eCommerce fraud before you get a call from a customer’s bank asking you to reverse fraudulent charges. To stop these transactions from ever taking place, you need tools that automatically flag suspicious behavior.

**Brute force protection** is one such tool, which prevents bot armies from overwhelming your site or app with login attempts. Enabling brute force protection locks out IP addresses after a certain number of failed login attempts.

[CAPTCHA](https://auth0.com/blog/captcha-can-ruin-your-ux-here-s-how-to-use-it-right/) (and its assortment of bot-catching descendants) helps to lock out bots at the account creation stage by having human users prove “I’m not a robot” and, occasionally, tricking bots into proving that they are.

**Breached password protection** protects against credential stuffing attacks by monitoring databases of compromised credentials and alerting users if they need to change their passwords.

It’s important to note that none of these technologies are foolproof, and none are designed to work in isolation. Some hackers have learned how to spoof fake IP addresses to mask brute force attacks. CAPTCHA always struggles to stay ahead of sophisticated bots that can mimic human behavior. And while retailers can force users to change their passwords in the event of a breach, they can’t change the underlying problem of password reuse. Even MFA, the bedrock of a sensible security strategy, works only if you convince or compel your customers to sign up for it.

But even though there’s no single silver bullet to prevent eCommerce fraud, implementing these features together offers superior protection. Scammers generally seek out the path of least resistance, and when you have all these tools, you don’t present your business as a soft target. 

![Prevent Fraud by Updating Customer Access Controls](https://images.ctfassets.net/23aumh6u8s0i/1MzswDFUmttHgwNE85rxY2/cc3066d34b3cc682703051845d44b7fc/prevent-ecommerce-fraud-separator-2)

## Prevent Fraud by Updating Customer Access Controls

We’ve talked about the threats to eCommerce retailers and the tools to protect against them, so the question now is, how do you go about putting those tools in place? For many retailers, the solution is to partner with a third-party [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) provider. That’s because building fraud-preventing tools in-house is time-consuming for any business, and it’s out of reach for most small to medium-sized retailers. But sticking with the simple login solution you’ve had in place for years is clearly no longer an option.

But as we’ve discussed, all fraud-prevention tools are not created equally. Here’s what retailers should look for when analyzing potential CIAM partners.

### Customizable MFA

There’s no reason to challenge every loyal customer to prove their identity every time they make a purchase, so retailers need [step-up or adaptive MFA](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/), which requests additional credentials only in the event of suspicious or high-risk behavior. For example, you may want to verify a customer’s identity if they log in with a new device or place an order above a certain dollar amount.

![Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

Auth0’s Adaptive MFA analyzes every login attempt and assesses its risk level. This assessment included a user’s IP reputation, whether the login is coming from a known device, or whether its geographic location indicates so-called “impossible travel.”, Based on these factors, it then determines whether the login can proceed uninterrupted, triggers MFA, or blocks the account altogether.

![Customizable MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Comprehensive Attack Protection

Likewise, retailers need anomaly detection that lets them combine the strongest tools available to deter scammers. [Auth0’s Attack](https://auth0.com/docs/anomaly-detection) Protection offers an arsenal with which businesses can protect themselves. That includes Bot Detection, which forces suspicious logins to take a CAPTCHA test. Suspicious IP Throttling and Brute Force Protection block IP addresses from trying to break into user accounts. And Breached Password Protection notifies customers if a user’s credentials have been compromised in a known data breach.
Lets customers implement CAPTCHA and enable brute force protection, and notifies them about breached passwords.

![CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/7KwQQhPVnPr15lr3S73mdz/dc8846b93ba9384500c0bc155928ad84/attack-protection-04)
Here’s a look at Auth0’s Attack Protection tools.

### Developer-friendly documentation and support

Finally, in order to put safeguards in place as quickly and easily as possible, retailers should look for a CIAM solution that provides a high level of documentation and support. While many identity providers have similar suites of tools and services, the time it takes to implement them can vary widely depending on what kind of instructions they give to developers. Having clear documentation and customer support is particularly important to smaller businesses, who don’t have dedicated authentication professionals on their teams.

## An IAM Partner Can Get You Holiday-Ready

It’s been an indisputably challenging year, but retailers have risen to the occasion by embracing eCommerce solutions. And as 2020 comes to a close, it’s increasingly clear that eCommerce isn’t just a stopgap solution for the pandemic &mdash; it’s the new status quo. That means that updating security is a worthwhile investment for the entire coming year, not just the holiday rush. To learn more about how state-of-the-art identity can protect your customers and your business, [reach out to the team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />

How Retailers Can Prevent Ecommerce Fraud This Holiday Season

Securing customer loyalty means offering choices about how to shop.

Retailers in the COVID-19 era have been forced to integrate their digital operations with their brick-and-mortar stores as a means of survival. According to research from digital signage platform [Raydiant](https://www.raydiant.com/blog/reopening-of-retail/), 55% of retailers report that without expanding into e-commerce, they’re unsure whether they would have survived the pandemic, or they’re certain their business would have failed.

Yet the same research found that only a small fraction of retailers plan to keep these integrations of physical and digital operations in place after the pandemic (14% for delivery and 17% for curbside pickup).

This disconnect shows that marketers and data officers still don’t fully appreciate the harmonizing of digital and physical operations and making them flexible enough to respond to changing customer needs. But it is possible to express brick-and-mortar strengths in the digital world; it just means getting smart about your [omnichannel strategy](https://auth0.com/blog/why-an-omnichannel-strategy-is-critical-in-2020/). Here are three ways to start.

## Use Brick-and-Mortar Stores for Online Pickups and Returns

In recent years, retailers have discovered that using physical stores for fulfillment and returns are key to staying competitive in the age of Amazon. These options are convenient for customers and good for retailers since customers who step inside a store are more likely to make a second purchase.

Implementing a buy online, pick up in-store (BOPIS) program has been a particularly valuable strategy during the pandemic since it lets customers minimize the amount of time they have to spend in stores. As early as April, the [National Retail Federation reported](https://nrf.com/blog/how-retailers-are-adapting-curbside-pickup) that half of the consumers used BOPIS because of the pandemic.

In the long run, buy online, return in-store (BORIS) may prove to be just as valuable to retailers as BOPIS because it ensures quicker restocking of returned items and eliminates the cost and logistical challenges of accepting returns by mail.

### Let customers choose

Integrating stores into online pickups and returns is most effective when you present it to customers as a choice and let them pick the method that’s best for them. When a customer needs something urgently, they can pick it up that day, but if they don’t mind waiting, they can get the item delivered and save themselves a trip to the store. Walmart credits this strategy for its success during the pandemic. Its online sales rose 97% in the second quarter but not at a cost to store sales, which grew 9.3%.

[Walmart CEO Douglas McMillon](https://multichannelmerchant.com/ecommerce/walmart-posts-blowout-ecommerce-growth-nearly-doubling-sales-q2/) plans to keep weaving together online and in-person strategies with an omnichannel approach in which “the customer is ultimately in charge.” Walmart plans to add a membership program to further drive loyalty by giving customers flexibility. Says McMillon: “Sometimes they’ll be in the store, and sometimes they’ll do pickup, and sometimes they’ll do delivery, and many of them will buy a membership.”

### Unite all locations with a single inventory

Successfully implementing these programs requires a high degree of visibility into both customers and inventory. You need access to a customer’s geographic location, and you need to pinpoint the location of the product they’re looking for. With this information, when a customer is browsing online, you can provide them with the best options at checkout. If the item they want is in a far-off warehouse, deliver it. If it’s at their neighborhood store, let them pick it up. If it’s at a store a few miles away, give them a choice.

“Flexible inventory is the best inventory,” noted [Jonathan Jonas](https://multichannelmerchant.com/wp-content/uploads/2020/05/mcm_warehouse_software_report_v5.pdf), co-founder of eCommerce infrastructure consultancy Decent Startup. He predicts that in the coming years, “we could also see more and more same-day offerings as fulfilling eCommerce orders from store becomes a normal part of everyday operations.”

## Personalize Customer Outreach Without Being Invasive

Retailers are always looking for ways to give their brand that “personal touch,” and for marketers, that increasingly means targeted digital outreach. Properly employed, these efforts can drive customers to your stores, but it’s important to be cautious about the data you ask for and how you use it.

Some retailers, for instance, have experimented with using customers’ location data to send notifications to customers’ phones when they’re near a store. However, retailers need to use this data cautiously or risk alienating consumers.

[Mike McGuire, VP analyst for Gartner Marketing](https://www.chiefmarketer.com/gartner-analyst-qa-martech-innovations-in-the-covid-19-era/), points out that “proximity does not equal permission. Many consumers will keep location tracking off of their applications because they don’t want to be pestered.” He says that Gartner’s surveys found that consumers will enable location tracking only in cases when it delivers value to them: finding a store near them or if a product needs to be delivered to them.

### Prioritize privacy and choice in data collection

Keeping customer value and privacy in mind is critical in assessing how you should collect and employ personal data. Gartner recognizes this growing concern, and they included “[customer data ethics](https://www.chiefmarketer.com/martech-innovation-gartners-hype-cycle-for-digital-marketing-2020-report/)” on their 2020 Hype Cycle for Digital Marketing. This highlights the need for retailers to be transparent, legally compliant, and secure, even as they innovate. That means, at a baseline, that personally identifiable data should be encrypted and access to it should be rigorously controlled. At a time when customer trust is everything, you don’t want to squander it with a data breach.

There are less invasive methods for targeted digital marketing that can still drive customers to stores. For instance, optimizing your company for local SEO is still the best way to find new customers instead of losing them to online competitors.

You should also look for opportunities for targeting that require customers to directly opt-in, like emails and push notifications that tell them about sales at their local store. [_Multichannel Merchant_](https://multichannelmerchant.com/blog/digital-tools-help-retailers-adapt-post-quarantine-world/) suggests using in-store signs to promote digital marketing. “Stores can have signs for customers to text ‘Welcome Back’ to a five-digit number to receive an exclusive promotion. A quick text elevates their store visit and opts them in for future updates.”

## Guarantee Adaptability With an Omnichannel Approach

We don’t know when the pandemic will end or how it will affect consumer habits in the long-term, but the retailers that survive and thrive will be the ones that embrace [organizational change](https://academy.whatfix.com/change-management-101/) to stay aligned with their customers. The only way to do that effectively is with an omnichannel strategy that lets you allocate resources to the right channels and make adjustments as you go.

![Omnichannel Diagram](https://images.ctfassets.net/23aumh6u8s0i/4R9jiLsQ22iKfF5nFYW5qm/5e22f180c5c980130af02a358c9d7d04/omnichannel_diagram)

First and foremost, this requires retailers to know these customers on both a broad and granular level, and tailor your approach to them based on your knowledge. In an effective omnichannel approach, user identity is the connective tissue between digital and physical transactions. It’s what lets you create seamless customer experiences and maintain visibility over your customers and their habits. A customer can order a product on their laptop, get a push notification on their phone when it’s ready, and pick it up curbside; it works because the retailer’s identity management system keeps track of their journey, from computer to mobile device to physical location.

To get this bird’s-eye view of customers, use your [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) system to create a single source of truth about each customer. Each interaction with your company&mdash;whether in-store or online&mdash;feeds into a central profile, which enables better audience segmentation and marketing. The analytics from your CIAM platform will give you real-time insights into shoppers’ habits, so you can provide the right experiences based on their needs.

The important thing is to build adaptation and evolution into your strategy. Right now, an omnichannel approach may mean using your physical stores to promote digital channels, like retailers with signs out front that advertise curbside pickup. In the future, when the pandemic subsides, you can use digital marketing to encourage customers to return to stores.

And in the meantime, use those digital channels to keep customers informed and connected to physical stores. Post updates about the health precautions your company is taking. Use blogging and social media to humanize your in-store teams and keep the personal connection alive.

## Brick and Mortar Doesn’t Have to Mean Stuck in the Mud

Customers don’t want to choose between in-person and online shopping. What they want and expect are retail experiences that let them effortlessly move between channels.

When you embrace your customers’ flexibility, you can start finding more flexibility in how your digital and brick-and-mortar operations complement each other. Your stores can simultaneously be showrooms, warehouses, and community hubs. Your customers will use digital channels to tell you which option they need. You just need to have the capabilities to listen.

<include src="asides/AboutAuth0" />

Three Ways Retailers Can Harmonize Brick-and-Mortar and Digital Operations

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Sporting goods retailer’s commitment to constant digital innovation drives enhanced login

**BELLEVUE, Wash. – December 11, 2019 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has been selected by DICK’S Sporting Goods, a leading omnichannel sporting goods retailer, to provide a superior customer login experience for every customer (‘athlete’) who interacts with the online brand. Auth0 will power the login experience for DICK’S digital properties – website and mobile – and enable athletes to access information and merchandise with even more ease and security than before. 

DICK’S is a leading omnichannel sporting goods retailer that offers an extensive assortment of authentic, high-quality sports equipment, apparel, footwear, and accessories. Headquartered in Pittsburgh, PA, DICK’S caters to millions of athletes’ sporting goods needs on its digital website, [www.dickssportinggoods.com](http://www.dickssportinggoods.com). This past year, DICK’S embarked on a digital transformation project that included identity management as a critical component. 

In addition to implementing [Single Sign On](https://auth0.com/single-sign-on/), they also wanted to have a modern identity solution that offers leading-edge options, such as passwordless authentication. 

“Our athletes and their experience on our digital properties is one of the most important factors in retaining our loyal fan base and continuing to expand our business to new audiences,” said Bob Pecina, VP of Technology, DICK’S. “After a solid review of solutions on the market, Auth0 provided us with the ease-of-use and scalability we were looking for in an identity management solution. They could also achieve our time-to-market goals, which was a deciding factor with the upcoming holiday season.” 

DICK’S will roll out new login features across its digital brands in the next few months and continue to leverage Auth0’s many product features to continually enhance the user experience. 

“Working with DICK’S and the scale in which they need to support their massive fan base is so exciting, and is certainly something our platform is designed to handle,” said Ghazi Masood, VP of Americas for Auth0. “We are especially thrilled to support DICK’S during this holiday season, and provide its loyal athletes with the ability to digitally access what they need as easily and securely as possible.” 

Auth0 is proud to help DICK’S and other major enterprises stay ahead of the competition by creating a better login experience. For more information about [Auth0’s customers](https://auth0.com/customers), please visit the company’s website. 

<include src="asides/AboutAuth0" />

### Media Contacts

Kaycie East 
Auth0 Communications 
[press@auth0.com](mailto:press@auth0.com)

Alex Plew 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

DICK’S Sporting Goods Turns to Auth0 for Industry-Leading Login Experience

shafiq-shivji

Shafiq leads Product Marketing for Auth0's Ecosystem and Extensibility domains. He brings vast experience from previous roles as a Product Manager and Sales Engineer working in adjacent SaaS industries like machine learning, web/mobile apps, and communications. He especially enjoys the creative process of conceiving and taking high-impact products to market.

Shafiq Shivji

The right digital initiatives can turn your brick-and-mortar locations into your biggest assets against e-commerce competitors

It wasn’t long ago that showrooming — the tendency of customers to examine a product in a store and then go online to compare prices and make the actual purchase — was considered one of the four horsemen of the so-called retail apocalypse.

However, in recent years, savvy retailers have learned how to use showrooming to increase revenue. More and more [_success stories_](https://www.forbes.com/sites/forbesbusinessdevelopmentcouncil/2018/05/16/how-brick-and-mortar-stores-are-making-a-comeback-with-millennials-and-gen-zers/#54db375c1640) feature traditional retailers aligning their digital and brick-and-mortar operations, so each drives sales for the other. Instead of driving customers away, they’re building brand loyalty by creating tailor-made experiences online and in person.

Historically, retailers found showrooming so damaging and difficult to counteract because customers engaged in their browsing anonymously. Retailers had no way of understanding their customers’ behavior or of appealing to them once they left the store. This lack of shared customer data robbed retailers of the ability to leverage their unique advantages against e-commerce competitors. Now, however, more CTOs are recognizing that smart [_identity management_](https://auth0.com/retail/) is the key to keeping customers within the sales funnel, regardless of where they make a purchase. Below, we’ll discuss how to implement an approach to identity that helps your digital and physical stores feed into each other’s operations and drive revenue growth.

<div class="alert alert-info alert-icon">
 
 Security vs. customer experience has been a longstanding challenge in retail, but retailers no longer have to choose one over the other. <a href="https://info.auth0.com/IdentityinRetailReport.html">Discover the intersection between CX and reliable security.</a>
</div>

## Create a Single View of the Customer

If you want to turn showrooming to your advantage, you have to create a seamless customer experience across all touchpoints, thereby providing a more compelling, personalized environment than online price-shopping. Designing this experience first requires a comprehensive understanding of your customer.

Implementing [_social login_](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) across all your digital channels is a simple, efficient way to build a rich user profile. Social login confers several advantages, the first being that its simplicity increases the likelihood that customers will sign in since they don’t have to create a new set of credentials for your site.

Of course, customers who use social login then share a wealth of information about their attributes, interests, and location. Armed with this information, you can send more tailored and helpful recommendations their way—as well as guide customers back to your physical retail store. Social login is also crucial in creating the same experience across all digital touchpoints since their profile will be consistent regardless of where they sign in.

![Single view of the customer](https://images.ctfassets.net/23aumh6u8s0i/1Ro1NRBQRzpra6UhFFQDTR/74464aec53334c1931b02da0adbe4821/single-view-of-the-customer)

Building data-rich user profiles is only half the battle, though. That data can’t do anything to hang on to showrooming customers if it’s siloed on your digital storefront. To fully align your operations, it’s critical to integrate identity management with your existing CRM.

Auth0’s platform integrates with any CMS, analytics, or e-commerce platform, including [_Microsoft CRM_](https://auth0.com/docs/integrations/sso/dynamics-crm) and [_Salesforce_](https://auth0.com/docs/integrations/sso/salesforce). Integrating identity management with your existing SaaS tools enables you to share this single view of the customer with the systems that can put it to best use. For example, using [_geofencing_](https://www.salesforce.com/products/marketing-cloud/best-practices/geofencing-marketing/#) with your CRM can alert you to a customer browsing a store, with no need for login. Your sales team is now alerted and empowered by easy access to a customer’s profile. In some cases, you can even write a customized rule that if a customer enters and exits the store without purchasing, the CRM [_automatically alerts_](https://docs.microsoft.com/en-us/power-platform-release-plan/2019wave2/microsoft-flow/running-flows-geofence-generally) your digital marketing team to follow up with them.

The surgical precision of such a method is exactly the type of digital initiative that retail CTOs can get excited about; it’s not tech for tech’s sake, but a data-driven means of patching a revenue leak. Integrating customer data across channels is both cutting edge and a fairly simple way to streamline operations. When digital and physical stores share a rich and holistic view of the customer, it ensures that they are working collaboratively, not at cross-purposes.

## Introduce Endless-Aisle Technology

For a retailer, there’s nothing more disheartening than a customer who comes in search of a popular item, finds that it’s out of stock, and walks away saying, “I guess I’ll just order it on Amazon.” Endless aisle is the solution to this problem.

Endless aisle refers to the practice of providing customers with an in-store digital touchpoint from which they can order an unavailable product and have it shipped to their homes. Implementing endless aisle can be an effective method of wooing customers, even those who walked in only intending to showroom. For example, a touchscreen positioned next to a display can direct a customer to a “special release” version of the product available only through the retailer.

Endless-aisle tech also allows retailers to offer a wider variety of sizes, colors, or styles of any product, without the store having to stock them. It’s a way that CTOs can help achieve leaner inventory management without compromising on customer choice.

The possibilities expand further if you implement social login on your endless-aisle touchpoints since the reduced friction increases the likelihood that customers will actually use it to place an order. Auth0’s easy [_social login_](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) has been demonstrated to improve conversion rates and registration. When a customer logs in — even if they don’t make a purchase — you have a record of the interaction and can follow up with email and targeted ads.

Various retailers have experimented with different approaches to endless aisle, from installing kiosks to setting up tablets to using “beacons” in store aisles to send [_push notifications_](https://blog.getenjoyhq.com/the-3-golden-rules-of-push-notifications/) directly to a customer’s smartphone. Regardless of which solution makes the most sense for your business, Auth0’s platform is device-agnostic, so using identity to make a purchase is as easy in the store as it is on a mobile app or website.

<include src="TweetQuote" quoteText="Learn about endless-aisle technology and how it can help you woo customers."/>

## Use Customer Data to Facilitate Reverse Showrooming

To fully seize on the revenue-driving potential of showrooming, you shouldn’t treat it as a one-way street, steering customers from brick-and-mortar locations to digital stores. Instead, you can use effective identity management to create a cyclical relationship between touchpoints, playing to the individual strengths of each.

Using your digital presence to encourage customers to show up in person is a phenomenon known as webrooming, or “[_reverse showrooming_](https://www.fool.com/investing/2019/03/19/call-it-reverse-showrooming-these-companies-are-ca.aspx).” With your single view of customer identity, you can send personalized email reminders, offers, and targeted ads to drive shoppers to stores.

Certain types of retailers are particularly well-positioned to capitalize on webrooming because their products all but require customers to try them on or sample them in person. [_Ulta Beauty_](https://www.fool.com/earnings/call-transcripts/2019/03/15/ulta-beauty-ulta-q4-2018-earnings-conference-call.aspx), for example, credited its in-store sales increase to “incorporating relevant product recommendations and replenishment reminders across digital channels” in what it called a “reverse channel shift.”

Customer data can also drive revenue and cut costs in ways that go beyond traditional marketing initiatives, as in the case of returns. A [_2018 CBRE report_](https://www.supplychain247.com/article/holiday_season_heightens_challenges_of_online_returns) found that returns comprise 8% of sales for brick-and-mortar retailers, while online shoppers return goods at levels from 15% to 30%. But with effective identity management, you can turn this behavior to your benefit. With well-organized, accessible data, you can direct customers to their local store to return the product they bought online. Not only does this allow for immediate restocking and save on shipping costs, but it also gives you a chance to make another sale once the customer is in the building. It’s just one example of the many creative, often overlooked, yet valuable ways a robust identity management system can allow CTOs to directly contribute to cost savings.

<include src="TweetQuote" quoteText="Learn how webrooming uses your digital presence to encourage customers to show up in person to your store."/>

## You Can Turn Showrooming from a Problem into a Solution

As long as you’re keeping customers in your sales funnel, and not losing them to the competition, showrooming can deliver some surprising benefits. For example, when a customer tries on a pair of shoes in the store but purchases them online, they’re far less likely to order the wrong size and put the retailer through an expensive returns process. However, unless your physical and digital channels are fully integrated, you’d have no way of knowing the important role your store played in that transaction, so you might mistakenly conclude that the store isn’t contributing to sales.

Once you have an identity management system in place that de-siloes your customer data, you can ensure that just because a customer walks out the door, you haven’t lost the chance to make a sale. If you’re in search of digital initiatives that directly address business needs, partnering with an identity management platform like Auth0 is an easy way to turn a loss into a win. Reach out to an [_Auth0 resource_](mailto:%20sales@auth0.com) for customized insight.

<include src="asides/AboutAuth0" />

How to Leverage Showrooming Behavior to Increase Revenue

Concerns of a breach prompting global retailers to invest in advanced identity management

**BELLEVUE, Wash. – April 2, 2019 –** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced key findings on how retailers are approaching data security and customer experience in light of widespread data breaches and cyber attacks. Based on a survey of nearly 100 global retailers and case study examples collected by Internet Retailer, the report highlights how the age-old battle of security vs. customer experience is now being solved with modern identity management technology. More details from the 2019 Retail Data Security Report can be found [here](http://info.auth0.com/IdentityinRetailReport.html).

Retailers are in constant competition with each other to increase revenues, maintain customer loyalty, and offer the best user experience possible. But according to the survey, security comes first, with 35 percent of respondents ranking “securing customer and employee data” as their highest priority. Next comes the shopping experience for their consumers, with 29 percent of retailers citing “increasing conversion rates” as their second priority.

Security vs. customer experience has been a longstanding challenge in retail, but retailers no longer have to choose one over the other, thanks to today's modern approach to identity and authentication, like Auth0. With a single, centralized system for shopper identities, a retailer can reduce risk with extra layers of authentication, easily capture data to understand consumer preferences, and personalize the end-to-end experience.

The high costs of a breach are spurring retailers to invest heavily in identity, especially given that one in seven retailers surveyed had experienced a data breach in the past year. Nearly three-fourths of retailers (72 percent) cited multi-factor authentication as the top strategy to combat a data breach, followed by stronger passwords (53 percent), and step-up authentication based on user behavior (37 percent).

"Retailers are rarely experts in identity management, nor should they be. Implementing any authentication technology can be incredibly complex, and that's where an identity specialist like Auth0 can help," said Dave Wilner, Chief Revenue Officer at Auth0. "We're proud to provide retailers around the world with a universal identity solution that not only removes the burden of worrying about security, but also enables them to provide a much better shopping experience to their customers."

To read the full report, please visit: <http://info.auth0.com/IdentityinRetailReport.html>.

### **Media Contacts:**

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898


Mark Fowler 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com) 
+44 (0) 77 1124 4113

Securing Customer Data Tops List of Retailer Priorities, According to Survey By Internet Retailer

Implement MFA, store minimal information, and take employee cybersecurity training seriously to minimize data breach risk.

The holiday season is the biggest shopping time of the year, and for that reason, it's also the most popular time of year for cybercriminals. 

If you’re a [retailer](https://auth0.com/retail), it's on you to ensure that your customers' data is safe. [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) hurt your customers and they hurt your reputation. 

With this post, we show retail teams how Auth0 can help them keep customers safe with three actionable tactics. 

While these strategies are critical during the holidays, they're also highly applicable throughout the year. Teams that take security seriously are those that will safely scale and thrive in 2019 and beyond.

## 1. Implement Multi-Factor Authentication

With data breaches of retailers on the upswing in 2018 — including ones at [Macy's](http://fortune.com/2018/07/11/macys-data-breach/) and [Adidas](https://www.newsweek.com/adidas-breach-hack-us-website-customers-warned-their-data-has-been-hacked-1000974) — teams clearly need extra support. [Multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) delivers this. Implementing it correctly can make a huge difference in how secure your customers’ accounts are. 

MFA ensures that even if a data breach does occur and passwords are leaked, hackers still can't get into customer accounts. To do so, they need a second piece of sensitive information, like a customer's thumbprint, facial features, or mobile device.

With [Auth0 Guardian](https://auth0.com/multifactor-authentication), you can add MFA to your site simply and securely.

![Multifactor Authentication (MFA) with Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/4x4BhKDZLXWTlScCGVZ5B6/a53550e45f8a7d895b8ac2ae251c5a6d/multifactor-authentication-with-auth0-guardian.png))

After [installation](https://auth0.com/docs/multifactor-authentication/factors/push), retailers can easily switch on MFA push notifications. For your employees, it is a quick double-check that they are who they say they are (and that they can access sensitive customer data for work purposes). For your customers with the Guardian app, they receive a QR code on their device that they can scan before accessing their account. It's one more protective barrier to be sure they're not a hacker with the customer's credentials. 

With more than 80% of passwords having [inherent vulnerabilities](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/), MFA is a critical investment to seal your customer data from unwanted eyes during times of high activity.

## 2. Only store the data and information you need

Storing only essential customer data means that if someone does get into your system, there’s less to exploit. This is a key component of complying with the EU's [General Data Protection Regulation (GDPR)](https://auth0.com/gdpr). Some teams think that adhering to GDPR's strict standards is primarily to avoid hefty fines (the greater of €20 million or 4% of the global annual revenue); however, the standards are a must for protecting end users’ data and the integrity of your company.

If a cybercriminal does gain access to a company's confidential customer information, they can make off with:

* names
* email addresses
* mailing addresses
* phone numbers
* customer device information
* financial data
* personal details like age, race, and religion

[When hackers got into Under Armour's system](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) this year, they were able to access many customers' hashed passwords. Since studies show that people tend to [recycle their passwords](https://securityboulevard.com/2018/05/59-of-people-use-the-same-password-everywhere-poll-finds/), hackers have the ability to take these and access even more personal data in other accounts. The damage can quickly spiral out of control.

Storing less data can make you less of a target. You can also separate data, depending on how confidential it is. With [Auth0's user management solutions](https://auth0.com/user-management), you can restrict access to specific data sets for only the most privileged employees.

## 3. Train employees in the importance of cybersecurity

Training employees in the importance of data security is an often overlooked—but essential—pillar of protecting your customers’ data. Taking the time to bring them up to speed on the latest cybersecurity concerns early in their [onboarding process](https://www.intercom.com/blog/onboarding-focus-culture/) can help ensure that when the holidays roll around, they're on high alert.

When employees are aware of common hacks such as malware infiltration and phishing, they'll be able to recognize threats as they arise. And when they understand the reasons behind provisions such as automatic updates and multi-factor authentication, it’s easier to get their buy-in. 

Our blog has many pieces you can use to help communicate security issues to your employees. Here are a few to get you started:

* [Four Cybersecurity Attacks Your Employees Need to Know](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/)
* [What is a Data Breach?](https://auth0.com/blog/what-is-a-data-breach/)
* [What is Data Security?](https://auth0.com/blog/what-is-data-security/)

You also might want to bring in experts for cybersecurity training sessions. While Auth0 doesn't offer these specifically, here are a few we recommend:

* *InfoSec Institute's [Security Awareness & Anti-Phishing Training](https://www.infosecinstitute.com/securityiq/).* The program includes more than 1,000 phishing simulations, along with tailored learner assessments, to bring employees up to speed.
* *[The SANS Institute](https://www.sans.org/about/)*. This non-profit was established in 1989 and now collaborates with 165,000 security professionals worldwide. Offers many private trainings to upskill existing IT team members.
* *Inspired eLearning. *These efficient modules even include [security awareness training programs for executives](https://inspiredelearning.com/security-awareness/awareness-c-suite/). 

Sometimes education isn't enough. If you do suffer a system breach, Auth0 can quickly step in to protect your customers with tools like [anomaly detection](https://auth0.com/docs/anomaly-detection) and [breached password detection](https://auth0.com/docs/anomaly-detection/breached-passwords). In the first instance, in the Auth0 dashboard, an admin will receive a notification of a strange behavior like multiple failed login attempts and can quickly block the user while researching the issue further. 

In the second case, Auth0's security team will work to keep a retailer informed if any of its customers' passwords match with those in our database of leaked passwords (which we update daily). If we see a match, we can work with a retailer's IT team to block the potential impersonator from getting further into the system.

### Take advantage of what the season has to offer.

Holidays are the most important time of the year for retailers. It's when most retail teams make the majority of their sales, and missing out due to a security breach can set you back several quarters or years from hitting your targets. It’s more important than ever to keep your customer data safe so they continue to trust and work with you.

It’s never too late – or too early – to start thinking about the best ways to do so. Auth0 would love to help. [Reach out](https://auth0.com/) at any time, and we'll be glad to set you up.

<include src="asides/AboutAuth0" />

3 Ways Auth0 Can Help Retailers Protect Customer Data During the Holidays

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

We’re sending an expert team to Shoptalk this year. Schedule a meeting to learn how Auth0 can help you increase conversions.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---
Just a few years ago, some retailers were hesitant about letting shoppers access online stores through social logins like Facebook or Google. Leading up to [Shoptalk 2018](https://shoptalk.com/), people headed to this year’s global retail innovation convention in Vegas are telling us that’s no longer the case — [one-click login](https://auth0.com/retail) has gone mainstream.

## Increased Conversions
At Auth0, we’ve helped customers like Polaris, Nando’s, Wayfair, The Iconic, Western Digital, Talbot’s, and more streamline their customer logins. Our customers find that social login increases conversions, removing unnecessary barriers to a pleasurable shopping experience.

Rather than losing a customer during login hesitation, social login also gives retailers opportunities for personalization while enabling them to deliver a consistent brand experience at each touchpoint. According to a [Web Hosting Buzz survey](http://www.webhostingbuzz.com/blog/2013/03/21/whos-sharing-what/): 86% of users report being bothered by having to create new accounts on websites.

## Phase I Replatforming - Identity

Another trend we’re hearing is the desire to replatform ecommerce experiences as a way to become more responsive to ever-changing customer needs. Shoptalk attendees are telling us that addressing identity is phase I in their multi-phase approach to becoming more agile.

Auth0 identity offers an opportunity to create a true omnichannel experience across brands with single-sign on, while also simplifying partner collaborations.

## Schedule Your Shoptalk Meeting with Auth0

We are sending an expert team, including a software architect, to Shoptalk this year. If you’d like to schedule a meeting to discuss how Auth0 can help increase your conversions, personalize engagement, streamline partnerships, and build brand loyalty, please reach out to [sales@auth0.com](mailto:sales@auth0.com).

---

<include src="asides/AboutAuth0" />

Meet with Auth0 at Shoptalk 2018

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how a B2C Company implemented Single Sign-On to provide seamless integration between different e-commerce portals.

Implementing Single Sign-On in B2C Applications

Auth0 provides secure login and authentication for JDA’s retail customers

**BELLEVUE, WA -- January 8, 2018** – [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it has been selected by [JDA Software Group, Inc.](http://www.jda.com/), as the identity and access management (IAM) solution for its next-generation solutions that are part of JDA NEXT, such as JDA Retail.me and JDA Store Optimizer. Using Auth0’s extensible platform, JDA will provide secure and seamless information access to its users.

The JDA NEXT product strategy includes solutions that leverage edge technologies such as advanced analytics, artificial intelligence, the Internet of Things, machine learning, and SaaS to help retailers strategically plan and streamline operations around consumer buying behavior. With a need for Enterprise Federation across these solutions, JDA turned to Auth0 for its ease-of-implementation, flexibility, and compliance with modern security protocols.

“After a thorough review of competitive IAM solutions, Auth0 provided the best platform that matched our focus on flexibility and the customer experience,” said John Vrankovich, principal architect at JDA. “It was much more cost-effective for us to outsource authentication to Auth0, and the fact that it could be implemented quickly across all our next-generation JDA solutions is what sealed the deal.”

Enterprise Federation requires a great deal of time and internal resources. With increasing demand across growing business networks for fast information and the need for control over access, Auth0 has become a trusted partner to companies like JDA, that need an extensible platform that easily integrates with any combination of APIs, identity providers, protocols, custom databases, and deployment models.

“One of the primary reasons B2B organizations turn to Auth0 is Enterprise Federation. Relying on our platform allows companies to deliver results faster, more securely and efficiently than building internally, plus it eases developer resources to then focus on product innovation,” said Eugenio Pace, CEO and co-founder of Auth0. “We are very excited about working with JDA and growing with them as their far-reaching customer network continues to expand.”


<include src="asides/AboutAuth0" />

JDA Standardizes Identity and Access Management with Auth0

Auth0 explores the Data-Driven approach to eCommerce and how retail analytics can help you optimize procurement, merchandising, and marketing

Retailers are always fighting for better predictions of what their customers want. From setting price points to predicting next season's trends, [retail](https://auth0.com/retail) has been working to move faster and be more efficient since its inception.

<include src="TweetQuote" quoteText="Retailers are always fighting for better predictions of what their customers want."/>

That's why every retail company has some form of *retail analytics* in place. Retail analytics is data in and around the creation, distribution, and purchase of products. Keeping track of what percentage of your inventory is still in stock would fall under *retail analytics*, but so would data about the efficacy of your new marketing campaign. 

As consumers have adopted device after device and service after service, eCommerce worked hard to create robust methods of tracking and analyzing a flood of new retail data. Retail analytics today is more powerful and more flexible than ever before. For marketers, salespeople, and product people, it is the way forward for eCommerce.

Here's everything you need to know to keep up with *retail analytics* for today and tomorrow. 

## What can you expect from retail analytics?

When something encompasses production through sales, its possibilities seem almost endless. Right now, though, the big uses for *retail analytics* center on optimizing procurement, optimizing merchandising, and optimizing marketing.

### Optimizing procurement

One of the key places that *retail analytics* helps businesses is **optimizing procurement**. By better predicting sales numbers, procurement and stocking gets more efficient. Retailers can also better see the cost balance for a given materials vendor, with more visibility into how the different purchases from a single vendor add up. 

### Optimizing Merchandising

When it comes to merchandising, **product appeal** has always been a huge consideration for retailers. With digital marketing and eCommerce, it's only gotten more important. The color of landing pages, the music in product videos, the packaging that an item comes in when someone receives it in the mail — these things are all important factors that replicate the “in-store experience” for digital consumers. And they're things that marketers are testing to optimize for the most appeal to online shoppers, who have their attention going in 700 different directions.

![Retail Analytics - Optimizing Merchandising](https://images.ctfassets.net/23aumh6u8s0i/1uK9nzv2IQrcWwjlaikcIm/dc37cf9f813f1ed99553591ba78570b3/optimizing-merchandising)

> _"The best packaging [...creates] memorable marketing," [writes](https://www.forbes.com/sites/onmarketing/2014/07/23/the-five-things-product-packaging-must-do/#7cfd6433ac4f) Simon Preece for Forbes._

Another big place that companies are constantly tweaking with the help of *retail analytics* is **pricing**. Companies like [Price Intelligently](http://www.priceintelligently.com/) have made whole businesses off of analyzing how to optimize pricing by digging into data about customers, price points, and pricing strategies. Even companies that aren't outsourcing their pricing strategy are still paying close attention to what their consumer data tells them about how much a customer is willing to pay for their product.

### Optimizing Marketing

The digital age birthed more sales channels than ever before, and now it's rushing to catch up to them. Consumers find their way to products across social media, shopping websites, word of mouth, meatspace ad campaigns, emails, and magazines. To track all of these channels is difficult, but *retail analytics* is getting better at tracking across devices and digital channels to give a better idea of **which ads are working online**. 

<include src="TweetQuote" quoteText="The digital age birthed more sales channels than ever before, and now it's rushing to catch up to them."/>

**Ad targeting** is another area that can be positively influenced by *retail analytics*. As users login with their social accounts for eCommerce sites, see targeted ads on social media, and are retargeted after purchase, more information about their demographics, habits, likes, and dislikes are gathered. This means that *retail analytics* can streamline ad targeting for happier customers and happier marketers. 

![Retail Analytics - Interest Targeting](https://images.ctfassets.net/23aumh6u8s0i/5MDdOkV4JJyYEAzc0bJlRK/a8f4da62b0481e368ed5e11749132960/but-no-one-else-would-trick)

> _[Digitalmarketer](http://www.digitalmarketer.com/facebook-advertising-targeting-options-social/)'s literal ad target shows one way to determine ad interest and reach by using the “but no one else would” trick._

## Trends in retail analytics

Digital retailing has both given a boost to traditional *retail analytics* and allowed companies to create new ways to follow their digital commerce. While companies are going to continue to refine *retail analytics*, the *retail analytics* trends of today are strongly tied to our ideas about multichannel commerce and will likely continue in this vein. 

### Oldies but goodies

Let's start out with some of the “traditional” *retail analytics* that have stood the test of time. These are some baseline heavy-hitters. Where before, people might have tracked these manually, they have now been supercharged by contemporary analytics platforms. 

* **POS analytics.** Point of Sale analytics, or POS analytics, is a broad field that uses the information that relates to the final sale of an item. This started as simply a log of payments and has progressed as sales technology picked up, gaining steam from the mid-1980s onward. Now, POS analytics will cover not just what was purchased and by whom, but also where that item was stored or shipped from, and information about the customer (rewards points, address, email, etc.). Almost every eCommerce system comes equipped with basic POS analytics — [Shopify](https://www.shopify.com/retail/improved-retail-analytics-help-merchants-dive-deeper-into-data-to-bolster-sales) is a great example. 

* **“Traditional” marketing analytics.** Marketing has been around forever, and old-school analytics have made their way over to digital. Tracking the basics of marketing campaigns is easier with marketing tools, and many of them put bells and whistles on basic marketing stats, like ROI on mailing campaigns. Google Analytics or built-in analytics on platforms like Facebook Business often serve as an easy way into this type of data.

### New kids on the block

What's happening in *retail analytics* today isn't just refreshed POS analytics. More data is being collected, which means there's more to dive into. The *retail analytics* trends of today are focused on looking at more micro-level actions or strings of actions that are predictive, rather than simply using analytics to form assessments of marketing schemes or to find macro trends. 

* **Micro marketing analytics.** Digital analytics platforms have allowed businesses a greater window of insight into their marketing analytics. Now, it's easier than ever to look at more micro-level marketing data (like how many impressions a customer needs before they purchase), what items are likely to be purchased together or in subsequent orders, and live updates of A/B testing on campaigns. 

* **Sentiment analysis.** Sentiment analysis is a new way of determining how customers and potential buyers feel about your product. It uses text analysis to determine how your customers are talking about your products on channels from on-site product reviews to comments on your social pages. [Sentiment analysis](https://auth0.com/blog/4-ways-to-calculate-your-customers-happiness) helps predict trends, gauge customer reactions to products and marketing materials, and can be the missing link that explains sales fluctuations.

![Retail Analytics - Social media real time sentiment analysis](https://images.ctfassets.net/23aumh6u8s0i/5rw5l3OakrHAJCvIYKDzZa/ca074dc53bd1d85a277d2ded7e9ad1b7/social-media-realtime-sentiments)

[[Source](https://www.linkedin.com/pulse/introducing-social-media-real-time-sentiment-analysis-debajani)]

* **Omnichannel analytics.** With all of the different platforms available to customers, and all of the paths customers take to purchase, getting a robust view of how your customers are purchasing across platforms and devices is crucial. While some software, like [Sellbrite](https://www.sellbrite.com/ecommerce-reporting/), include multi-channel eCommerce reporting, companies also turn to their IAM to help them stitch together [customer identities](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) across channels. This can help eCommerce companies build and track brand experiences.

### The future 

Moving commerce online was the first in a series of chain reactions that have opened an entirely new world for retail and marketing. Even though technology and techniques seem to move at lightening speed, the truth is that eCommerce, shopping and marketing analysis, and behavioral analysis of customers has been slow to perfect. While getting targeting capabilities, cart abandonment numbers, and CTR stats has been quick, true customization for retailers, shoppers, and marketers is just beginning. 

* **Better predictions and forecasting.** While companies like [SAS](https://www.sas.com/en_us/solutions/analytics.html#forecasting) are investing a lot of energy into building forecasting capabilities, [predictive analytics](https://auth0.com/blog/predictive-analytics-why-is-it-important/) for retail will get better as more customer data is collected and software is better able to track and integrate that data across channels. Because predictions and forecasting are holistic efforts, as each part of data-rich eCommerce improves, so will these capabilities.

* **More IoT data.** It's no secret that the IoT has more and more [use cases](https://www.interana.com/blog/the-top-iot-analytics-use-cases-today/) as each year passes. More connected devices will mean a better picture of your eCommerce customer and their behaviors. eCommerce is also likely to build its own integrations with IoT devices — think [Farmstead](https://www.farmsteadapp.com/) integrated with your smart fridge — and this will bring a whole new set of data to process. 

![Retail Analytics - The Internet of Things and the mythical smart fridge](https://images.ctfassets.net/23aumh6u8s0i/52FGQ6wdqOVIBaR1GA6569/10ec870dbfa0fec766f9451db849e7cc/mythical-smart-fridge)

[[Source](https://uxmag.com/articles/the-internet-of-things-and-the-mythical-smart-fridge)]

## Getting your data together

The more that eCommerce progresses, the better *retail analytics* is going to get. Right now, companies and platforms have the capability to collect a huge amount of data, but we're still in the process of refining [how to use it](https://auth0.com/blog/all-you-need-to-know-about-data-management-and-integration/). Marketing is getting smarter and optimizations are being made all the time. From startups to the enterprise, eCommerce software is trying hard to figure out the best ways to help companies use customer data.

<include src="TweetQuote" quoteText="The more that eCommerce progresses, the better retail analytics is going to get."/>

For now, you should be looking at a combination of tried-and-tested *retail analytics* and newer approaches to retail data, like putting together cross-channel analytics and predictive metrics. The good news is that things aren't changing quite as fast as we think they are, and there's plenty of time to ramp up your analytics to get ready for the next step in eCommerce business.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

Retail Analytics: Past, Present, and Future

Integrating cloud security services into your app not only keeps you and your users safe, it can actually accelerate your development process.



Over the course of the 2010s, cloud computing has shifted from being a bleeding edge solution to a standard expectation in data management. Not only has it allowed consumers and the enterprise to flexibly scale their storage needs, it has also redefined the software industry towards a cloud-based service model.

There are a ton of other benefits, allowing developers to streamline their development process and offer users a more refined and accessible experience. But what's one cloud advantage that the mobile app industry hasn't taken full advantage of? Security.

By delegating specialized tasks like IAM and encryption to cloud services that are 100% committed to following the latest security standards, you can spend more time building out your app without sacrificing the security of your users. In a cutthroat marketplace, delegating high-stakes features such as IAM to cloud providers can give you the competitive advantage you need to succeed, all while improving the security practices of your users.

## Security Advantages of The Cloud

Relying on a distributed cloud model for your security and authentication needs is a bit of a no brainer, as a developer you'll have more time to commit to making your app the best it can be, all while making sure your users are well taken care of.

The main advantage of cloud services in security and authentication contexts stems from their distributed nature. If you had an in-house authentication or data storage platform, a single point of failure might emerge, leaving your users stranded. But by relying on distributed authentication or hosting services, with multiple backups and agile update schedules, you can count on a more stable and scalable backend to keep your users happy and safe.

![Amazon EC1](https://images.ctfassets.net/23aumh6u8s0i/1Biy5EkrCPetFFit29avAh/ff3dbcec5cab9ef7febc49eaf1d86dea/ecs1)
_[Source:](http://www.allthingsdistributed.com/2015/07/under-the-hood-of-the-amazon-ec2-container-service.html)  Amazon's EC2 Container Service helps reliably balance cloud resources and clusters within a system._

In the case of Amazon Web Services, their concept of [“systems containers”](https://aws.amazon.com/blogs/publicsector/improving-security-with-cloud-computing-six-advantages-of-cloud-security/) sheds light on how cloud security structures can actually serve as powerful analytics tools. Due to the bubble-like nature of cloud systems as they surround traditional systems, they can provide insight into irregular behaviors and perform load balancing. Even if a cloud system isn't actively aware of the inner workings of each system element, it can create reactive responses and protect the integrity of your platforms.

By allowing your backend to be self-regulating, scalable, and constantly updated to the latest standards, you can make your app far more responsive to changing security threats and technologies.

## Why Outsource Identity?

At the end of the day, most developers simply don't have the time or expertise to build out robust IAM or data encryption platforms — developers need to delegate in order to give their users access to the best service possible. Luckily, that's where the cloud services model has proven to be most valuable, enabling you to externalize the most difficult platforms to the experts.

### USE YOUR RESOURCES EFFICIENTLY

As a developer, one of the most overlooked aspects of the development process is figuring out how to design your app to adhere to the most stringent security and authentication standards. It's a tall order — you can't be expected to be an expert in everything, yet nightmares stemming from bad security practices loom large.

What's worse, many users rely on developers, designers and onboarding to nudge them towards responsible identity behaviors, but mandating the strictest security practices can be a turn-off — that's a lot to balance.

By integrating a cloud IAM framework into your app, not only are you able to ensure that your users are adhering to industry standards, you also can actually make both development and user experience easier.

### ADHERE TO INDUSTRY STANDARDS

One of the best practices for rock-solid IAM is to use [Multifactor Authentication](https://auth0.com/docs/multifactor-authentication)(MFA). MFA allows your app to verify users using multiple devices, such as SMS, allowing you to mitigate impostors.

![Guardian Push](https://images.ctfassets.net/23aumh6u8s0i/1snZRjltIO6EdRAmpAEDOx/c3372491fed8e2a459ce6dd01236209e/guardian-push)

_Source: Auth0's [Guardian](https://auth0.com/multifactor-authentication) multi-factor authentication platform makes it easy to add Identity verification in your app._

MFA has quickly become an industry standard, but it requires a ton of backend work, ranging from SMS integration architecture to hardware tokens. For smaller developers, creating an MFA strategy from the ground up is an inefficient use of resources, so it makes sense to use an external cloud-based service like Auth0 to integrate with your login and onboarding flows.

### STREAMLINE YOUR SIGNUP

Social login is popular because it helps users who are less motivated to sign up using their email and password to simply sign up using their Facebook or Google accounts in just 1 or 2 clicks, avoiding the often cumbersome nature of traditional signup flows.

As a result, social login is becoming increasingly ubiquitous, and it has allowed developers to become familiar with integrating Identity APIs in their code. If developers are willing to use plugins and APIs to make their users' experiences just a little bit easier, they should also consider external cloud IAM solutions to bolster their security strategy.

The decision to outsource identity is ultimately up to each developer, for use cases as audience needs are highly variable. But developers should consider how easy it is to add cloud services to their stack, and learn about the benefits of additional identity-driven [analytics capabilities](https://auth0.com/learn/powering-user-analytics-identity/) that they enable. In such a competitive market, any efficiency and/or experience improvement can have a profound impact on the success of products.

## How Auth0 implements Cloud Identity

While it might seem like it's overwhelming to implement a cloud IAM architecture like Auth0, it's actually quite easy. Auth0 is immensely flexible, offering SDKs for a wide range of platforms, ranging from Java, PHP, Python, and iOS, among others, and allows developers to build upon it with C# or JavaScript to suit their needs.

Structurally, Auth0 serves as a bridge between apps and users, aiding in authentication and identity processes using the [OAuth2](https://auth0.com/docs/protocols/oauth2) protocol. The OAuth2 protocol enables users to grant regulated permissions from one site onto a different site, without having to expose their credentials. This is done through access tokens, which represent the granted permissions:

![Mobile API](https://images.ctfassets.net/23aumh6u8s0i/7D51x7o8JqhfOlvkrN1cVb/901f5c1e1699aa5a6a3b5383da8b00b2/mobile-api)

By default, Auth0 runs in the public cloud, but you can choose to run it privately on large cloud hosting services like AWS, or even locally if you're so inclined. Regardless of the structure of your app and its dependence on either local or cloud platforms, Auth0's cloud IAM acts as a stable go-between that can provide consistent service and agile updates as security standards evolve.

Whether you're in a time crunch or simply just want to have bulletproof IAM built into your app, implementing Auth0 into your product is quick and easy. If you're an iOS developer, all you need to do is add a few lines of code into your app for the [Lock](https://auth0.com/docs/libraries/lock-ios/v2) embeddable login form to start working.

## Embrace Cloud Security for a Competitive Edge

When developing a new app, creating high-stakes tools for authentication and data security can seem insurmountable. Instead of building out an imperfect system and putting you and your customers at risk, you could always rely on a service like Auth0 to take care of the hard details, enabling you to make better use of your resources.

The app space can be incredibly cutthroat, so any way to make your app more efficient and robust can translate into a real competitive advantage. By delivering a product with top-tier IAM and cloud architectures, you can deliver a more scalable and agile product that will be able to stand out in the marketplace.


Moving Your App to the Cloud

Your API documentation can make or break a sale. Learn how to unleash its full potential.



The whole point of APIs is to save developers time.

Developers don't need to reinvent the wheel on mapping, or payments, or secure authentication because they can just plug into APIs that will take care of all of these issues.

To sell your API, you need to prove that it is the amazing shortcut developers have been looking for.

When your API's documentation is clunky, slow, and difficult to use, it's going to be hard to make that narrative work. There are a lot of APIs out there, not giving your users a clear path to what they want is a good way to drive them elsewhere.

Instead, imagine your documentation as a sales team. What would you want your sales team to do? Attract developers, make them understand why your API is so helpful, and provide them with straightforward, continuous, personalized customer support.

Documentation can perform all these tasks. Great documentation can quickly immerse developers in your product and provide them with simple, customized content from wherever they want.

## Get users into a demo quickly

Your API's documentation is competing for people's attention with everything else that's out there, Snapchat, The New York Times, iMessage, sleep which means it needs to make an impression fast. In under 15 seconds to be exact, according to [Chartbeat](http://time.com/12933/what-you-think-you-know-about-the-web-is-wrong/).

One way to do this is to get a developer playing around with your API before those 15 seconds are up.


[Stripe](https://stripe.com/docs) is a great example of an API that gets users trying out the product quickly. Right as you open their documentation, you see a 6 step demo that walks you through how Stripe creates and charges customers.

![Stripe docs trialbox](https://images.ctfassets.net/23aumh6u8s0i/3T66zva0xJc9jakXUGftdK/d15497e158ec4e7541203811930855bd/stripedocstrialbox)

It takes about 3 seconds to get through step 1, which is just clicking a “Submit” button. This short first step is key as users are actively playing with the API before they can lose interest. Before those 15 seconds are up, they already have a great preview of the value the API can add to their app. By the end of the demo, they've seen how easy it is to add a new credit card, associate that card with a unique customer, and charge that customer. They even know how to set up recurring charges and subscribe the customer to a new payment plan.

Once the demo is completed, links pop up to take users to more detailed pages. These pages are more likely to be read by developers who have already experienced the worth of your API and want to learn more.

You have very little time to excite users and explain your product—so get them into a demo fast.

## Make it easy to understand

If developers find your documentation confusing, they won't stick around. No one wants to bother with an API they can't understand.

You could and should try out stylistic changes and test which creates the best pathway to understanding. However, at the end of the day you're going to come down to one issue—you wrote this, not the user. Why not reduce that imbalance?

Substituting user-created values for your own whenever possible helps the users truly understand what your API is doing.

Consider [Airtable's API documentation](http://airtable.com/api), which is customized specifically for the Airtable database already created by the user. You don't see generic field names or example values, you see the entries that you actually interact with in Airtable every day. Rather than “Field 2” you see “Assignee.” Rather than “task11” you see “Fix lion cage.” It makes the API immediately familiar and easy to get started using.

![Airtable API documentation](https://images.ctfassets.net/23aumh6u8s0i/16jiGo8owxNnda5F8rU1Mo/c345515ce26fb92f3ba32ecd9f09174b/Airtable_API_-_Theme_Park_Projects_and_How_to_Build_Documentation_That_Will_Drive_Sales-2)

Customizing the documentation for each user reduces confusion. What could be easier for a developer to understand than their own variables? If developers can easily understand your API's requests and responses they can get a better view of its value.

## Embed documentation everywhere

A developer who has already logged into your site is serious about trying your API. The last thing you want to do is remove them from this process by taking them back to your public page to view the documentation.

However, people will want to access your documentation from everywhere: your public page, logged in, Github, etc. You want it to be seamlessly available in all these places at once.

You could just have your documentation embedded on one page and link the user from place to place. However, every time you link a user out of the site they're in, they become less likely to go back.

If you're serious about accessibility and reducing friction for developers, embed your documentation everywhere. Of course you're not expected to actually write multiple copies. Rather, create your documentation in Markdown on Github. Then you can embed it anywhere using the wiki system Markdocs. That way, users can directly access your documentation from everywhere.

Creating your documentation in Markdown also lets you tailor it to different groups. Libraries like Lodash can be used to integrate user details into how the documentation is displayed. In your documentation, include “if” statements to reduce the amount of unnecessary information a user sees.

For example, the two images below are from the same page of Auth0 documentation. There are two distinct steps numbered 4, and Lodash is used to display one or the other based on whether or not the user has indicated that they would call a third party API or their own API. Thus, the developer does not have to waste time trying to find relevant information.

![Third Party API](https://images.ctfassets.net/23aumh6u8s0i/1UPV63UweUA9olrUfpIZRw/188270af78955e4934f979802b7625ee/3rdpartyapiarrow)

![Third Party API - Lower section](https://images.ctfassets.net/23aumh6u8s0i/1BMpxDcLs1jOgAs5kkwh7d/7191a07997f8d4d09a22db5317135187/yourapiarrow)

Don't put any roadblocks in your user's way. Every piece of extraneous information, every link is a point where the user might reassess their focus on your product.

Let developers see what they want, where they want. Putting your documentation everywhere allows you to keep users engaged rather than taking them away.

## Offer customized sample projects

We learn best through [experiential learning](https://blog.readme.io/the-most-effective-api-quickstarts-in-8-examples/), so having a developer engage with a sample project is an excellent way to get them hooked.

Sample projects are now expected, but *customized* sample projects can really make your documentation accessible. The closer a sample project is to what would actually be purchased, the more likely a developer is to like it and buy it.

At [Auth0](https://auth0.com/docs), we have sample projects available for dozens of different front and back-end languages, each of which is fully customized with a user's API keys when downloaded.

![Auth0 documentation page](https://images.ctfassets.net/23aumh6u8s0i/c9COYwSQ7WutyYpmLmA74/c68f24cfd6d5c153b3423fb229702fdd/auth0doc)

All of the necessary configurations are already done, the user gets a fully personalized README to work through, and they're spared all of the tedious setup usually involved in trying a new product. A developer should leave your documentation knowing how their app would function with your API and thinking, “that was easy.” That is what customized sample projects will get you.

## Stop wasting developers' time

Developers rely on APIs to reduce their workload, so use your documentation to reduce it as much as possible. Minimize the number of clicks and scrolls it takes to get someone playing with your product. Don't make it overly complicated. And customize it to their needs to the best of your abilities.

Documentation is a reflection of your API. If your documentation is quick, simple, and personalized it says your API will be too, and thus worth buying.

To learn more about creating great documentation, [check out this talk from our VP of Marketing](https://www.youtube.com/watch?v=lw9R2qMCdqk) at the Forward 2 Web Summit.


How to Build Documentation That Will Drive Sales

Brand advocates are your best and most authentic influencers — so how can you create more of them?

Brand advocates are the holy grail of customers. They're a key part of growing your customer base because they love your product and encourage others to use it. Of course you wish every customer were a brand advocate.

<include src="TweetQuote" quoteText="Brand advocates are the holy grail of customers. Of course you wish every customer were a brand advocate."/>

So, can you better connect with *regular* customers to turn them into all-important brand advocates? Creating that valuable, personal connection to your brand is difficult. Especially today, when you're communicating across multiple channels, and trying to [stitch together your customers' behaviors](https://auth0.com/blog/how-to-keep-up-with-hyperconnected-consumers/) from in-store purchases to tweets.

[Identity management is your secret weapon for this](https://auth0.com/b2c-customer-identity-management) — it helps consolidate customer information so you can add that personal touch whenever people log in or stroll into a store and interact with your brand.

## Use social login to kickstart personalization

Login is the beginning of getting to know your customer. It's a great way to start collecting information about them that you can use to better their brand experience and personalize your interactions.

One of the easiest ways to do this is to use [social login](https://auth0.com/learn/social-login/). Customers often want an easy login that doesn't require them to open yet another account with yet another username and password, and social removes that barrier for customers. It also streamlines their login after they create an account; if they are logged into the social network, they'll be able to log in with one click and no keystrokes at all.

In addition, shopping is a social experience, something that's replicated on a lot of eCommerce sites. Referral programs that use customer's social login to suggest sharing rewards with friends, and even allowing personalized gift wrapping and messages through websites speak to the social nature of shopping. If you have any social rewards or features, social login is the way to go.

![Social brand](https://images.ctfassets.net/23aumh6u8s0i/2KJWdNR3f4v4ALlFQqo24T/8bd7547df16c50baa3ff5a5000b55337/socialbrand)

There's a lot more you can do on the back-end to kickstart your personalization as well. [With Auth0](https://auth0.com/retail/), you can grab information from social login, like email, birthday and Facebook pages liked. You can use this across marketing efforts — those make for the start of a pretty good birthday coupon email, for example.

In this way, social login encourages a better relationship between brand and customer, especially when that customer might not get to step into a brick and mortar store with their friends and make connections with salespeople and products.

## Engage over time with progressive profiling

You want to build a relationship with your customers, and that means learning about them over time — it doesn't happen just because you ask a customer what they're like on day one. There's no way a customer would ever sit through a survey that asks everything you want to know about them — but they still want that personal touch.

That's where [progressive profiling](https://auth0.com/blog/progressive-profiling/) comes in. Progressive profiling is slowly nudging the customer over time and learning about their preferences, likes, dislikes. It's also about knowing when the right time to ask for information is — you want to identify when customers will share the information you need, which probably aligns with how much they've realized the value of your product.

<include src="TweetQuote" quoteText="Progressive profiling is slowly nudging the customer over time and learning about their preferences, likes, dislikes."/>

Progressive profiling is easy when done by triggering questions at login. Maybe the first login you only take their basic information, but the third or fourth time they log in, you ask them where they work or what types of deals they'd like to see from you in their inbox.

![Progressive profiling](https://images.ctfassets.net/23aumh6u8s0i/4NGl4bbBsfyaXlgKyCEe7d/0ec045decb569e0bb0f989bed7b32894/progressiveprofiling)

This will allow you to foster your relationship based on the personal information an individual consumer gives you. Maybe you're an online cosmetics retailer and you send a free sample with every purchase over $50. You can give different people different gifts — ones they'll actually want — based on what they tell you.

So, instead of sending everyone the same sample, you can send perfume samples to those who are interested in fragrance, and a hair mask to those who told you their concern was healthy hair.

Gathering personal information from a customer can lead to forging a more meaningful — and valuable — relationship between you and them. They are actually better served by your business, because you can cater to their individual needs. In turn, they'll be more likely to recommend and talk up your brand to others. And that's a cycle that can continue for their entire lifetime as a customer.

## Streamline your personalization with a single view of your customer

We've just discussed gathering information on customers to make their experience more personal. But where do you store that information, and who has access to it?

With Auth0, each user in your system has a centralized profile where information is stored. Their login history, the information from their social login, progressive profiling, and other information you collect can be stored in that profile, which gives you a [360-degree view of the customer](https://auth0.com/blog/360-view-of-customer-by-managing-identity/). You can set access so that everyone who is interacting with customers has real-time access to that information.

This profile within Auth0 also helps maintain a single view of your customer in other ways:

* **Accounts are linked and centralized.** If a user has multiple social accounts that they log in with, or if they log in with social one time and email the next, Auth0 can link these accounts to a single, central profile. No more duplicate users will be lingering in your system.

* **Brand umbrella challenges are eased.** If a single retailer has multiple portals or different brands under the same umbrella, it can be a difficult task to centralize those to get one profile for every user. Using Auth0 across portals and brands takes some complexity out of matching profiles for different brands.

* **Cross-device use is streamlined.** Just as using Auth0 helps with keeping track of users across brands, using a sophisticated IAM helps consolidate users who log in across different devices. The same, centralized profile is able to consolidate no matter where users log in, or with what device.

All of this helps you build an [omnichannel](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) or [unified](https://auth0.com/blog/how-to-keep-up-with-hyperconnected-consumers/) experience for your customers, who want a seamless experience across brands. And as you stitch together consumers' digital presence and how they interact with your brand, you can better target them at each stage of their journey.

## Better personalization with Auth0 Rules

That centralized profile is also the perfect way to take advantage of the [true power of a robust identity management system like Auth0](https://auth0.com/user-management). With Auth0 in particular, it's a great way to take advantage of [Auth0 Rules](https://auth0.com/docs/rules/current) — snippets of code that you add to kick in things like grabbing information from a user's profile.

<include src="TweetQuote" quoteText="With @auth0, each user in your system has a centralized profile where information is stored."/>

While you can write your own Rule to help your marketing efforts, you can also rely on a library of existing rules. Many of them can help with bolstering personalization efforts in marketing. A couple that highlight this focus are:

* **Adding demographic data to a user profile.** Using [this](https://auth0.com/rules/add-income) Rule, you can add median household income to your user profile based on the zip code of their IP address. Zip codes can open up a lot of possibilities for personalization, and this is a great one.

* **Using FullContact to enrich your profiles.** With [this](https://auth0.com/rules/get-FullContact-profile) Rule, you can enhance your users' profiles with data from FullContact using their email address. The data that's collected — for example, job title — is automatically added to your profiles.

By incorporating information with Rules, you can easily pull in what you need to personalize your interactions with customers. Best of all, it's zero friction for users, who don't have to answer questions or fill out surveys.

![Auth0 Rules](https://images.ctfassets.net/23aumh6u8s0i/7BKAMMkQnFx4Qic1ZZWpGz/d2a8d0af23b99488da7cc018293e3d10/rules)

_Attributes you can add to a customer's profile using [Auth0 Rules](https://auth0.com/docs/rules)._

So if a customer comes into the store and you've pulled their birthday from their Facebook, an associate can automatically apply a birthday month discount. Marketers can look at individuals, or overall trends to set up more effective campaigns. This single view of your customer helps that customer get the same, personal touch every and anytime they interact with your brand.

It strengthens your brand as a whole, and makes that customer feel like they're not just another number in your system that nobody pays attention to. When customers feel that they're being valued as an individual, they associate that with your brand and, in turn are more likely to go from customer to advocate.

## Encouraging brand advocacy

Making your best customers your brand advocates means fostering deep customer engagement. One of the best places to start fostering that engagement is by personalizing your interactions with customers.

The best way to get into that personalization is to capture all the information your customer is giving you and make that accessible for marketers, sales people, and anyone who could help the customer benefit through personalization. You're aiming to nurture your customer relationship over that user's lifetime. Paying attention to and asking them about their likes, dislikes, and habits is a key component of that.

This is a tough task, but using your identity management to track and store information takes what you already have — login — and turns it into a valuable tool for encouraging customers to become brand advocates.

> Auth0 provides the simplest and easiest to use [user interface tools to help administrators manage user identities](https://auth0.com/user-management) including password resets, creating and provisioning, blocking and deleting users. [A generous **free tier**](https://auth0.com/pricing) is offered so you can get started with modern authentication.

Turn Your Customers Into Brand Advocates Through Personalization

Amazon's bold play for Whole Foods isn't just about the impending automation of the retail sector, it's about the increasing importance of IAM in redefining consumer behavior.



Amazon is poised to reinvent the grocery store from the ground up. They've been experimenting with cutting-edge retail automation through their Amazon Go experiment, leading to strong speculation about how they're going to enter the brick and mortar grocery market. Now we've got our answer: with Whole Foods.

The high-end organic retailer is likely going to be a pilot for applying the highly anticipated Amazon Go model: a way for consumers to shop without ever waiting in line for a register — a massive shift that brings identity to the center of the retail experience. This is a bold play that is going to change the way [IAM works in retail](https://auth0.com/blog/jda-standardizes-iam-with-auth0/), and forever change consumer expectations and behavior.

In this article, we're going to break down the underlying architecture of Amazon's retail automation model, its impact on consumers, and highlight the ways in which [identity management](https://auth0.com/b2c-customer-identity-management) stands as the keystone of this entire [retail revolution](https://auth0.com/retail/).

## How Amazon Rethinks Shopper's Identities

Amazon has well-established forays into the grocery space with its Prime Pantry and Amazon Fresh services, but its first brick and mortar entry is the Amazon Go beta store in Seattle. As an entirely cashierless store, customers scan their phones as they enter the store, shop for the items they want, and leave the store without waiting.

![Wholefoods](https://images.ctfassets.net/23aumh6u8s0i/0rAvRGZ0WdOucQf3XEUnf/d9f816ec8e6bf2c9a3f9929bdd41deab/new)
_[Source](https://www.engadget.com/2016/12/05/amazon-go-grocery-store/)_

The technology is an ingenious combination of computer vision, sensor fusion, and Amazon's ability to assign these datapoints to specific customers. Cameras observe, track, and identify customers as they make purchases, and these are matched up with their Amazon accounts, allowing them to simply leave the store knowing that their purchases have been attributed to their accounts.

This is possible due to Amazon's 2014 [patent filing](http://bit.ly/2tWF8gB) for “Transitioning Items From a Materials Handling Facility”, which reveals the underlying systems at play that enable sensor data to be applied to specific customer identities.

According to the patent, an item identifier list — a customer's cart, so to speak is said to use skin tone identification to keep a customer's carts distinct from one another while in-store. Upon exiting the store, the user is identified so this internal store shopping list can be attributed to a customer's Amazon account. This reveals that identity is the key to seamlessly merging back-end stock logistics to front-facing customer billing.

Amazon Go is clearly a new benchmark for IoT retail. With its system, a store can at once know the real-time status of every item, attribute these items to individuals, and then instantly bill them for it.

The behavioral analytics potential of linking all stages of the supply and purchasing funnel is immense, allowing Amazon to pursue a more agile and responsive brick and mortar retail strategy. Customers might even be able to get real-time suggestions based on their shopping lists, or even get coupons for items they're mulling over — all because of identity.

## Implications for Whole Foods

Amazon's announcement of its intent to purchase Whole Foods not only has the potential to upend the grocery sector, it also promises to radically alter the retail sector in terms of identity management and employment policy.

![Whole foods Market](https://images.ctfassets.net/23aumh6u8s0i/2GiMCCBpLnwQt0sdgLnhLl/7dc8751c4acb1a46c19bea59cd9c5157/foods)
_[Source](http://www.wholefoodsmarket.com/stores/southlakeunion)_

Amazon's blueprint for a hyperconnected identity and authentication management system is in many ways unchartered territory. Grocers already do track shopping analytics through [reward card incentives](https://www.theguardian.com/money/2013/jun/08/supermarkets-get-your-data), which allow them to develop a complex view of their customer's behaviors. However, Amazon's novel unification of these backend analytics with specific customer identities increases the value of this data collection.

The consolidation of both front-end analytics and back-end logistics may be able to offer a whole host of new efficiencies in the grocery sector. Whether it be through a more agile inventory management system that reduces waste and spoilage, or by automation-led workforce reduction, Whole Foods may be able to pursue a more targeted and lean approach to its operations.

Additionally, given Whole Food's affluent and aspirational demographic reach, the experimental appeal of a new, automated shopping experience could prove to be a huge draw, not only for those who are excited to try the latest tech, but for those who will benefit from a more effortless shopping experience.

## Implications for Customers

It's still unclear as to how Amazon intends to scale its Amazon Go technology across hundreds of much larger stores across the US. Even murkier is how customers will react to these large, systemic changes in consumer behavior. Amazon will have to work to ensure that the friction of getting customers up and running in an Amazon Go-style store isn't prohibitive.

### Advantages for Customers:

The advantages of this shift to identity-centric IoT retail are pretty clear:

* Eliminations of lines, shoplifting, and cashiers could lead to savings that are passed along to consumers.
* Customers can access new insights into their spending and consumption patterns.
* The personalized experience of online shopping with hyper-targeted discounts and suggestions can now be experienced offline.
* Store stock can be more responsive to the needs and preferences of customers.

### Disadvantages for Customers

With all this flexibility that comes with identity-centric automation, there also comes the sense that Amazon is seeking to expand its walled garden ever outward.

* Consumers may not be comfortable with the accuracy of automated cashierless stores, or they might reject attempts to customize their shopping experience based on identification.
* Given Amazon's recent patent filing for [blocking comparison shopping-in store](http://tu9srvbirvvtmtukd3d3lnbhddjwzgyub3jn.g00.pcmag.com/g00/2_d3d3LnBjbWFnLmNvbQ%3D%3D_/TU9SRVBIRVVTMTUkaHR0cHM6Ly93d3cucGF0MnBkZi5vcmcvcGF0ZW50cy9wYXQ5NjY1ODgxLnBkZg%3D%3D_$/$/$), it seems like the overall approach isn't simply to make shopping more effortless for its customers, but also to proactively shape buyer behavior.
* While the convenience and hyper-targeting afforded by the Amazon Go model is a draw, there's also a chance that it alienates customers who already feel overly reliant on Amazon's retail ecosystem.

As retail automation becomes more reliant on customer identity to function, retailers should keep in mind that customers are willing to play along if there's a net benefit to them. Once they start to feel walled in or beholden to a monopolized retail experience, things can go awry, so it is in the best interest of retailers to not visibly commodify customer identity when developing IAM-centric automated retail platforms.

## The Road Ahead

Amazon's bold acquisition of Whole Foods indicates its willingness to radically upend one of the most staid and reliable sectors of consumer spending. While Amazon Go is a clear model for what Amazon wants to do in the grocery space, it's still unclear as to how it will apply this model to Whole Foods.

Regardless, it is clear that the future of retail is just as much about identity management as it is about the waning days of the cashier age. Amazon is betting that consumers are willing opt-into the necessary identity procedures that enable them to take advantage of seamless checkout and billing procedures. With Whole Foods now in its portfolio, Amazon will surely have plenty of room to experiment and refine this new paradigm of the retail experience.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Why Amazon and Whole Foods Will Change How You Shop

Getting ahead in retail means catering to your customers, and a single vision of your customers can help you do just that



[Retail is more complex than ever before](https://auth0.com/retail/). Customers are shopping any brand, everywhere on any device on multiple platforms. As if that weren't enough pandemonium for retailers, the digital age has ushered in entirely new models that never existed before, like selling on social media, or buying online and picking up in-store.

In a [retail](https://auth0.com/retail/) world with this much choice and this much freedom for a consumer, it's hard to recreate who your customers are. And, between in-store associates, merchandizers, marketers, digital content creators, social media managers, there are tons of people who need and can benefit from that information.

But you need a single vision of your customers for everything from sales to streamlining your digital experience. That means powerful systems that offer you the ability to track customers, centralize their information, and move their data internally to make this happen.

A cornerstone of this is your identity management system. Here are three key ways that your CIAM fuels your cross-channel retail strategy.

## Must-have #1: Centralized Identity Management

A single vision of your [customers begins with a single digital identity](https://auth0.com/b2c-customer-identity-management), each customer has their information stored in one central profile.

This calls for an [identity management system](https://auth0.com/user-management) that can handle logins from any device and funnel information on customers directly to their profile.

For retailers, Auth0 creates a single profile for every user in your system, and it can store information on their logins, their devices, their history, and centralize other data you want available on customers. You can link accounts back together, so if a user uses Facebook login one time and Google the next, their info still gets back to one profile.

![Central Profile](https://images.ctfassets.net/23aumh6u8s0i/7lagYYvb8urLSiIcSFf1ax/a864129cccc8e068adfbf3237ae0ff77/central-profile)

You're creating the base for the single vision of your customers by using a single profile as the determining source of information for each user.

For customers, this helps make the experience of engaging with your brand consistent. Any preferences they set and any information they give you can be used across all your channels.

To scale your centralized identity management with your business, Auth0 has a flexible user store directory model, so you can host your directory in the highly secure Auth0 server. You can also choose to use your own existing directory. If you ever want to migrate to the Auth0 database, you can do so without requiring a password reset. No matter what your retail size or needs, there's a way to get that must-have centralized CIAM.

## Must-have #2: Omnichannel Customer Experience

Once you've centralized your customer in your own database, you can move on to presenting an “omnichannel” experience for your customers.

In essence, this means that consumers are getting a seamless brand experience from you no matter where they're engaging. With all of the channels available to consumers today, it's important that people are getting the same brand message, the same options no matter how they engage with you.

![Brand Experience](https://images.ctfassets.net/23aumh6u8s0i/5aJClghOdMJtVneEqOfQ9R/25f0a39f62020df7dd2bdd5d850c954e/download)

Login through a CIAM is a great way to streamline your customers' first interactions with your brand. When you have a sophisticated identity management system, it can also facilitate branded interaction outside of login as well. Let's look at some of the ways you can do this with your CIAM:

* **Enable single sign-on for every brand on every channel.** Regardless of the channel or identity provider the customer uses, there should be a quick, consistent option for them every time they have to log in. That should include in-store access to their account.

* **Give people a social login option, every time.** The benefits of social login are twofold. Customers can easily access their account without having to make a new username and password. They will also benefit from the ease of personal devices where they are virtually never logged out of social, making social login functionally a one-click option. Retailers can benefit from the additional data available from social providers and use that to better connect with their customers.

* **Use your user profile as a starting point throughout your company.** Since your CIAM is now a central store for information from multiple channels, it should be used as a source of information company-wide. That means that in-store associates can bring up their profile to help them and that your marketers can show them ads for products they actually like.

Although the back-end of “omnichannel” retail is moving towards unified retail, consumers will expect that seamless, “omnichannel” experience to stay with them going forward.

## Must-Have #3: Integrations

Once you have started to develop a single view of your customer, and your customers have a seamless experience with your brand across channels, the next step is to customize the base you've built. This will help you build a robust view of your customers.

That means sharing all the data and insight you've stored up in your user profiles with the systems where they'll be the most useful. Certainly, you're going to want integrations with your marketing platforms and advertising networks to allow for better-targeted campaigns and in-app advertisements.

That means checking to see what solutions are available out of the box, and how flexible your CIAM is. Getting your profile data into your existing software is worth the effort it can take to streamline your SaaS tools. With Auth0, you can customize integrations for any CMS, CRM, ecommerce, or analytics platform. So whatever CRM or ecommerce system works best for you will be able to benefit from your data.

Of course, you also want to check out what features your platforms are offering you individually, not just how you can integrate all your different platforms. Any integrations that will help you get the most out of your identity management are going to strengthen the vision you have of your customer.

A great example of this is the new [Facebook integration for Auth0](https://auth0.com/learn/facebook-analytics/). If you have customers who use Facebook, Facebook Analytics for Auth0 allows you to learn more about those users through analytics breakdowns of categories like spending habits and education.

![Facebook Integration](https://images.ctfassets.net/23aumh6u8s0i/38oYDQFTdZEE5EFnDm9eqW/2fb439f422b1b723c469e8f8b5deec3a/facebookintegration)

This allows you to easily give your users a better, more personal experience across your channels without having to do extra legwork. When you're using the integration, you get a richer and more nuanced view of your customer. Many identity providers and business software have these types of useful additions that will bring even more power to your user profiles, and you need to take advantage of them to keep up with today's retail.

## When you know your customers, you'll connect with them

From marketing to sales to product, knowing your customers is a key part of building and maintaining your business. As the digital world offers consumers more and more possibility, forging that personalized connection is more important than ever before.

Building and enriching the single view of a customer is great way to get to know your customers. Using identity management to get there offers you an already-integrated and flexible solution that already fits your business. Don't be intimidated, use your [CIAM](https://auth0.com/b2c-customer-identity-management) to your full advantage to put yourself ahead, especially in ecommerce and retail.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


The 3 Best Ways To Create the Single Vision of A Customer (And What to Do With It)

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Learn these six tips that will help you shop online safely on Cyber Monday



---

Technology has made it very easy for people to purchase goods and services from the comfort of their homes. **Cyber Monday** is approaching, and a lot of people will be online watching the prices of their favorite items fall, ready to purchase them when the price drops far enough. Billions of dollars will be spent online during this popular *end-of-the-year sales* event. It's well known that a lot of online transactions happen during the months of October, November, and December. Unfortunately, a lot of fraudulent online activities happen during this time as well. Cyber criminals are most active during holidays, and a lot of online shoppers are negligent about cyber security threats. These kind of users make easy targets for hackers and cyber-criminals.

---

How do you stay safe while shopping online? I'll expatiate on six tips that can help you shop safely online on **Cyber Monday.**

## 1. Ensure that the site is secure by looking for https in the URL

Once you visit a website, ensure that the site has Secure Sockets Layer (SSL) encryption installed. The website will start with **https://** and a locked padlock will also be present in the address bar, near the URL. Don't attempt to buy anything with your credit/debit card on a website that has no SSL installed.

![Visit Secure Sites on CyberMonday](https://images.ctfassets.net/23aumh6u8s0i/7wJqzJ0zgyqqCbHlvqpjdw/cfb8474d9a636d4c621c4c78ec5ea306/Unsecure-Sites)
_Make sure you shop on secure sites_

## 2. Avoid using weak passwords

Hackers maintain a list of commonly used passwords that are deployed via bots to try on various websites at a time. Using a weak password increases the risk that your credentials could be randomly generated in those lists. If you currently have a weak password on the sites you shop with regularly, it's time to change to a very [strong](https://auth0.com/docs/connections/database/password-strength) password. Here are some tips to help you create a secure password:

* Use a long password, including at least 10 characters with a combination of numbers, symbols, and upper and lowercase letters.
* Avoid using common information such as your name, Social Security number, nickname, and so on.

![Avoid Weak Passwords on CyberMonday](https://images.ctfassets.net/23aumh6u8s0i/66bqIfE5R43vV3m91EWTyu/fb2cf7ea0f3dbd6fa20210f2b2808675/Weak-Password)

## 3. Look out for fake and forged Sites

During this shopping period, cyber criminals go to great lengths to replicate popular websites. Users can then get tricked into providing sensitive information such as usernames, passwords, Social Security numbers, and credit card details on fake versions of popular sites, thinking that they are logged into the real site.

Here are some tips to ensure that you don't log into a forged site:

* Look out for the encryption symbol, *padlock*, in the URL. Verify that the site is secure by ensuring that the URL starts with **https://** instead of **http**.
* Look out for typos in the site name and URL.
* Look out for fake ads and emails.
* Use anti-phishing software, such as **Kapersky** or **Avast**.

![Avoid Phishing Sites](https://images.ctfassets.net/23aumh6u8s0i/6oUZ40jndT2KjmMQ7mkefW/9193a67ac6cbfb154870a6748cb7c8a5/Phishing)

## 4. Try as much as possible to shop with trusted brands

There are various shopping websites that have earned a strong reputation over time. I advise that you shop on those websites that are globally recognized as trusted brands. These brands have experienced **Cyber Monday** events various times and have improved their **tech** to provide very robust security measures to handle the numerous online shoppers who will log into their platform.

**Note:** A lot of cyber criminals try to play on this mentality by creating fake versions of these popular websites. As I highlighted earlier in this post, look out for forged sites!

![Trusted Brands](https://images.ctfassets.net/23aumh6u8s0i/3O24gNN6nMGCFd9I4cbR0r/a5cf94640d5397ea61304c5a51c7d518/brand-logos_various)
_Source: https://thebrandthattimeforgot.files.wordpress.com_

## 5. Look out for malware and ad scams

During this season, social network scams and malware are on the increase. Lots of fake deals exist on the Internet. These fake deals, when clicked, direct you to fake sites and trick you to download, in some cases, antivirus software or software that can make you claim hot deals. In most cases, this software is malware that can steal information from your computer when installed.

Here are some tips to ensure that you are not a victim of these scams:

* Ensure that you have an up-to-date antivirus program installed on your computer.
* Ensure that your computer's operating system is up to date.
* Don't open URLs that seem suspicious.

![Social Media Scams](https://images.ctfassets.net/23aumh6u8s0i/1Dn4eRjA3sFSvrr64Hekol/02f6904560f0275fd0892df905c54008/Screen-Shot-2015-08-10-at-9)
_Source: http://adabouts.com_

You might see various ads that say **Claim this..** or **Claim that..** like the one below:

![Phishing Ad Banners](https://images.ctfassets.net/23aumh6u8s0i/5b7bSb5ZzzBFfWIEeXXgye/eca254c9097f11fe86e47d1bfeb9a8c7/Malware-2)
_Scam Ads_

## 6. Avoid deals that are too good to be true

Humans, by nature, are said to be driven by greed, so cyber attackers prey on users with this mindset by tricking users with incredible deals. During this season, various deals appear on social media that are just too good to be true. There is a popular [twelve scams of Christmas list](http://www.mcafee.com/us/about/news/2011/q4/20111109-01.aspx) compiled by McAfee. This list contains the popular examples of *too good to be true* deals. Try as much as possible to avoid deals like this!

## Aside: Stay Secure with Auth0

As a developer, you can use [Auth0 Lock](https://auth0.com/docs/libraries/lock) to authenticate your users. The lock widget uses **https** to ensure that users' information is transmitted securely.

You can also use Auth0's [Breached Password Detection](https://auth0.com/breached-passwords/) feature to ensure your users are protected from compromised credentials.

Futhermore, you can define **password policies** to customize the level of complexity of the passwords a user enters during sign-ups. Auth0 offers five levels of security matching the [OWASP password recommendations](https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls):

- **None (default)**: The password must exist and be at least one character long.
- **Low**: The password must be at least six characters long.
- **Fair**: The password must be at least eight characters long and must contain a lower case letter, an upper case letter, and a number.
- **Good**: The password must be at least eight characters long and must contain at least three of the following four characters: a lower case letter, an upper case letter, a number, or a special character (e.g. !@#$%^&*)
- **Excellent**: The password must be at least 10 characters long. It must contain no more than two identical characters in a row (e.g., "aaa" is not allowed). It must contain at least three of the following four types of characters: a lower case letter, an upper case letter, a number, and a special character (e.g. !@#$%^&*).

![Password Strength](https://images.ctfassets.net/23aumh6u8s0i/4Fi0J601exBxy5EBXti6jD/2840507af25ad497fd94a665ab872627/password-strenght)


## Conclusion

We have covered various tips on how to stay safe while shopping online on Cyber Monday. **One more tip:** *Its safer to use credit cards to shop online.* With credit cards, if there are suspicious unauthorized transactions on your card, you can contact your bank to reject the transactions and have your money refunded.

Happy safe shopping!!!


"retail"