CAPTCHA verification is a security tool designed to prove you are not a robot when accessing certain websites. The name stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.” CAPTCHAs present small tests that most humans can solve easily, but automated programs find difficult. They help keep websites safe from spam and fake accounts. Some ask you to type a set of distorted letters or numbers. Others display a grid of images where you click on traffic lights, bicycles, or crosswalks.
What are CAPTCHA scams?
Fake CAPTCHA scams are deceptive security checks designed to trick you into downloading malware or granting hackers access to your device. Real CAPTCHAs only ask you to tick a box or solve a quick puzzle. You shouldn’t be asked to download files or paste commands. Scammers mimic legitimate tests and after you click “I’m not a robot,” they instruct you to copy and run hidden code on your computer or phone.
Here are some signs to look out for:
- Unusual Demands: A real CAPTCHA requires only a single click or a quick image puzzle. It will never ask you to download a file, run keyboard shortcuts, or type a command into your terminal or run box.
- Sketchy Web Addresses: Be aware if the prompt appears on a strange, unrelated, or randomly generated domain.
- Phone Scams: Some mobile fake CAPTCHAs trick you into sending an SMS, which secretly enrolls your number in a costly premium subscription service.
If you fell for a fake CAPTCHA, you should immediately take the following steps to reduce the harm:
- Disconnect from the internet to stop the malware from communicating with the scammer’s server.
- Change your passwords for your most important accounts (e.g., email, banking, etc.) immediately.
- Use a trusted antivirus program to perform a full system scan and remove the malware.
- Check your bank statements for fraudulent charges and consider freezing your credit to prevent identity theft.
If you spot a suspicious CAPTCHA, report it to the FTC at ReportFraud.ftc.gov.
