Warning: Don’t Fall for Fake CAPTCHA Scams

Tom Wyant
7 days ago
3 min read

You have probably seen hundreds of CAPTCHA tests online.

“Click here to prove you’re not a robot.”

Usually, you check a box, choose every picture with a traffic light, and spend a few seconds wondering whether part of a bicycle tire counts as a bicycle.

Then you move on.

CAPTCHAs are so common that most people complete them without giving them much thought. Cybercriminals know this, and they are now using fake CAPTCHA scams to take advantage of that habit.

The latest version does not ask you to check a box or identify a blurry fire hydrant. Instead, it asks you to prove you are human by sending a text message.

That should be your first warning.

How Fake CAPTCHA Scams Work

You may reach a fake CAPTCHA page after clicking an online advertisement, visiting a compromised website, or following what appears to be a legitimate link.

The page looks familiar and presents the request as a normal security check. Instead of clicking pictures, it asks you to tap a button and send a text message.

When you tap the button, your phone’s messaging app opens with a message already written. All you need to do is press send.

It feels quick and harmless.

Unfortunately, that single action may cause your phone to send several messages to international or premium-rate numbers. In some cases, dozens of messages may be sent.

Each message can add a small charge to your phone bill. Those charges may not appear right away, which makes the scam harder to connect to the fake verification page.

By the time your bill arrives, you may have completely forgotten about the CAPTCHA you completed weeks earlier.

That is exactly what the scammers are counting on.

Why This Scam Is So Convincing

This scam does not depend on advanced hacking skills. It depends on habit.

Your employees already expect to see CAPTCHA tests. They have been trained by years of internet use to complete them quickly and continue to the page they were trying to reach.

The fake page only changes one part of the process. It asks the user to send a text instead of clicking a box.

That request is unusual, but it may not seem unusual enough to stop someone who is busy, distracted, or just trying to finish a task.

Some fake CAPTCHA pages also use aggressive browser behavior to keep people moving forward. The page may make it difficult to go back, display repeated pop-ups, or create a false sense of urgency.

The goal is to keep you from stopping long enough to think.

A CAPTCHA Should Never Ask You to Send a Text

Here is the most important thing to remember:

A legitimate CAPTCHA should never ask you to send a text message.

If a website tells you to send a text, run a command, paste something into Windows, download a file, or change a browser setting to prove you are human, stop immediately.

Close the page and do not follow any more instructions.

Do not worry about being rude to the CAPTCHA. Its feelings will recover.

What Your Employees Should Do

Make sure your team knows how to respond if they see a suspicious verification page:

Do not send a text message.
Do not download anything.
Do not copy and paste commands.
Do not provide payment or account information.
Close the browser tab or window.
Report the page to your IT provider.
Check the phone bill if a message was already sent.

If the browser will not let the user leave the page, they should close the browser completely. If that does not work, they should contact IT instead of continuing to click.

Security Awareness Still Matters

Security tools can block many dangerous websites, advertisements, and downloads. However, no security system can stop every threat.

Employees remain an important part of your company’s protection.

A short warning about fake CAPTCHA scams can prevent unexpected phone charges, malware infections, stolen passwords, and a long conversation that begins with, “I thought it looked legitimate.”

Make sure your employees know that online verification should never require them to send texts, run commands, or install software.

If you would like help training your team to recognize online scams before they cause trouble, contact us here. A few minutes of awareness today can prevent hours of cleanup later.