You are a security analyst for a large e$-$commerce company. You notice that a significant number of users are complaining about unauthorized transactions on their accounts.

After investigating, you suspect that the site might be a victim of a Cross$-$Site Request Forgery $($CSRF$)$ attack.

Which of the following actions should you take next?

answer

Implement a CSRF token in your web application's forms.

Implement CAPTCHA on all transaction pages to prevent automated attacks.

Ignore the complaints as false positives since the transactions are coming from the users' IP addresses.

Advise users to change their passwords immediately.