You have probably seen it hundreds of times:
“Click here to prove you’re not a robot.”
It feels routine. You tick a box, select a few images, and get on with your day. That familiarity is exactly what makes a new CAPTCHA scam so effective.
When verification turns into a costly text
Instead of asking you to click a box or identify images, a fake CAPTCHA page may ask you to confirm that you are human by sending a text message.
The page can look surprisingly convincing. You tap a button, your messaging app opens with a message already prepared, and all you need to do is press Send.
It seems simple and harmless. It is neither.
That single action may trigger multiple messages to international numbers, sometimes repeatedly. Each message can add a charge to your phone bill. Because mobile charges may not appear immediately, you might not connect them to a verification page you visited weeks earlier.
Why people fall for it
This scam does not require technical expertise. It relies on habit.
Your team sees CAPTCHAs frequently. They are accustomed to completing them quickly, and they expect the process to be inconvenient but legitimate. When a page looks familiar, people often follow its instructions without stopping to question whether those instructions make sense.
That brief moment of hesitation is important.
A CAPTCHA may verify that you are human through an interaction on the page. It should not require you to reveal information, send a text message, install software, or complete an unrelated step through your phone.
The page may come from somewhere legitimate-looking
Fake CAPTCHA pages are not always reached by intentionally visiting suspicious websites. They may appear after a user is redirected through a compromised website or advertising network.
A person can click what appears to be a legitimate link or advertisement and suddenly land on a page that imitates a familiar security check. Some pages use browser behavior or pop-ups to make leaving feel difficult, encouraging the visitor to complete the instructions instead.
The attack works because nothing seems obviously extraordinary. The page looks familiar. The button is clear. The request feels like an ordinary inconvenience.
What to do if you encounter one
Remember this simple rule:
CAPTCHAs should never ask you to send a text message to prove you are human.
If a verification page makes that request:
- Do not press Send.
- Close the tab or browser window.
- Avoid clicking additional buttons or links.
- Do not install any suggested software or browser extensions.
- Check your phone bill or messaging activity if you already sent the message.
- Report the incident through your organization’s security process.
If you entered a business website, application, or account through a suspicious page, access it again by manually typing the official address or using a known bookmark.
A few seconds of awareness can prevent a bigger problem
Security scams often succeed because they hide behind familiar routines. The request does not need to look dangerous; it only needs to look normal long enough for someone to act.
Teach your team to pause whenever a familiar process suddenly asks for an unfamiliar action. That small awareness habit can prevent confusing charges, wasted time, and a great deal of unnecessary cleanup.
Need help building practical security awareness for your team, including what to recognize and what to avoid? Get in touch.