How to best track conversions from account sharing prevention

When you start protecting your product against password and account sharing, it's important to track how many users convert after being challenged by the account sharing prevention feature. This will help you understand how effective the feature is and your ROI on implementing it.

There are two main strategies for tracking these conversions:

1. Tracking individual new accounts created after a user is challenged.
2. Tracking seats added to an organization after the users in that organization are challenged.

If your product is B2C, tracking individual new accounts created after a user is challenged is the best way to track conversions. You don't have the concept of "seats" in a B2C product and don't have to worry about tracking the number of seats added to an organization.

If your product is B2B using both strategies is the best way to track conversions.

We'll dive deeper into these strategies and how to implement them, but first, let's understand the user challenge/conversion journey.

Understanding the user conversion journey

When a user is challenged, they have a few options:

1. Create a new account immediately.
2. Verify they are the account owner and logout the violating devices (people).
3. Logout or abandon the challenge.

Conversion scenarios

A new account should be considered a conversion in the following scenarios:

1. User is challenged and chooses to create a new account immediately (and then actually creates a new account).
2. User is challenged and verifies or abandons the process but creates a new account sometime later.

In both cases, the user was driven to create a new account because they were challenged. Remember challenges are only shown to users who are sharing their account.

How to track conversions

Let's dive deeper into the aforementioned strategies for tracking conversions.

Tracking individual new accounts created after a user is challenged

• When Rupt determines that a challenge should be shown to a user, it will automatically set a cookie with the challenge ID then show the challenge.
• If a user creates a new account immediately, Rupt will pass the challenge ID to the new account creation flow as well as src=rupt&challenge=${challenge_id} in the new_account URL. You can use this to infer a definitive conversion.
• When a user creates a new account later, Rupt will automatically look for the challenge ID cookie and if found, Rupt assumes this new account was created because the user was challenged and will count as a conversion.

Tracking seats added to an organization after users in that organization are challenged

Tracking conversions for B2B products is a bit more straightforward. Besides the default conversion tracking of new individual new accounts above, you can track the number of new seats added to an organization that was previously challenged.

There are two ways to track this:

1. Using the Rupt dashboard

1. head to the Accounts page in your dashboard and filter by challenged = true.
2. Download the CSV of the accounts that were challenged and map the account_id to the organization. (Tip: use metadata to store the organization ID).
3. Find the seats of the organization before the challenge and after the challenge.

2. Using webhooks

1. Head to the Webhooks page in your dashboard and create a webhook that listens for the challenge.initiated event.
2. When the webhook is triggered, you can use the account_id to find the organization and update the number of seats in your database. (Pro tip: use metadata to store the organization ID this will allow you to skip grouping & lookups).
3. Store a list of all the organizations that were challenged and the number of seats they had before the challenge dates (we recommend doing a monthly window). For example, each month, track the number of seats in each organization that was challenged.

Data privacy and compliance

Rupt needs cookies & local storage to track conversions from account sharing prevention automatically. If required by law in your location, you may need to update your privacy policy to include this information. You should also update your cookie consent banner to include this information.

If you don't want Rupt to automatically set these cookies and local storage items, you can disable it by setting the conversion_tracking option to false in the rupt.attach function.

Conclusion

Tracking conversions from account sharing prevention is crucial to understanding the effectiveness of the feature and your ROI on implementing it. Rupt makes that easy by automatically doing most of the heavy lifting for you.