A CAPTCHA is a test a website uses to tell humans apart from automated software. It protects login pages, forms and checkouts from bots. A genuine CAPTCHA never asks you to install anything, run a command, or enter a password or one-time PIN — anything that does is a scam.
What is A CAPTCHA?
CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It is a challenge that is easy for a person and difficult for a program.
Most people meet it in one of these forms:
- Distorted text you have to read and type — the original design, now largely retired because software reads it better than people do.
- Image grids — “select all squares with traffic lights” or similar.
- A single checkbox — “I’m not a robot”. This looks trivial, and it is not measuring the click. It analyses how your cursor moved, your browser characteristics and your history with the site.
- Invisible checks that run in the background with no challenge at all, unless something looks suspicious.
- Simple puzzles — sliding a piece into place, or basic arithmetic.
The checkbox version confuses people most, because ticking a box seems like something any program could do. What is actually being assessed is everything around the click: the path your mouse took, timing, and dozens of browser signals. A human’s movements are irregular in ways automation typically is not.
A CAPTCHA is not a security check on you. It is not verifying your identity, your account or your permissions — only that a human, rather than a script, is at the keyboard.
What is A CAPTCHA used for?
Sites use them to stop automated abuse:
- Preventing bulk fake account creation.
- Protecting login pages from credential-stuffing — automated attempts using leaked username and password lists.
- Stopping spam in comment forms, contact forms and sign-ups.
- Protecting ticket sales and limited stock from bulk-buying bots and scalpers.
- Preventing scraping of pricing, listings or contact data.
- Protecting online voting and polls.
- Rate-limiting — slowing anything hammering a site with requests.
- Guarding password reset and OTP request forms from abuse.
They also serve a second purpose that is less obvious: some CAPTCHA systems use the answers to label training data for machine learning. Identifying buses and crossings has helped train image recognition. That is a real secondary use, and it is why the tasks are sometimes oddly specific.
When and why you may receive or see A CAPTCHA
You are more likely to be challenged when something about the request looks unusual — which is usually nothing to do with you personally:
- Logging in, especially after failed attempts.
- Creating an account, or resetting a password.
- Submitting a form or posting a comment.
- Checking out, particularly for high-demand items.
- Using a VPN or a shared connection. Traffic from a VPN, a corporate network or a mobile network shared by many users looks like it comes from one address doing a lot.
- Browsing with strict privacy settings, an ad blocker, or cookies disabled — fewer signals means less confidence you are human.
- Using an older browser, or one that is unusual.
- Making many requests quickly, or refreshing repeatedly.
- Connecting from a region or address with a history of abuse.
Repeated CAPTCHAs usually mean the site cannot get enough signal about you, not that you have done something wrong. Signing in, allowing cookies for that site, or turning off a VPN for the moment often stops the loop.
How to use or verify A CAPTCHA safely
Check the address bar before solving anything. A CAPTCHA appears on the site you are already using. If one appears in a pop-up, an email, or on a page you reached by clicking a link in a message, stop and go to the site by typing its address yourself.
Know what a genuine CAPTCHA never does:
- It never asks for a password, PIN or one-time code. Ever. It is not checking who you are.
- It never asks you to install software, an extension or an app to “verify”.
- It never asks you to open a terminal, press Windows+R, or paste and run a command.
- It never asks you to disable your antivirus.
- It never asks for card details, ID numbers or bank information.
- It never arrives by email or SMS asking you to “complete verification”.
If it is genuinely not working: refresh the page, try the audio alternative if offered, allow that site’s cookies and JavaScript, pause your VPN, update your browser, or try a different browser. Persistent failure on a legitimate site is worth reporting to that site’s support.
Accessibility. Most CAPTCHA systems offer an audio option for people who cannot complete a visual one. If a site offers no alternative at all, that is a shortcoming of the site.
Common mistakes, scams or warning signs
The “fake CAPTCHA” scam is now common and worth recognising. A page shows what looks like a normal verification step, then instructs you to press Windows + R, paste something it has copied to your clipboard, and press Enter — presented as “proof you are human” or a fix for a broken check.
That sequence installs malware. The paste is a command, and running it can hand over passwords, banking access and files. No real CAPTCHA has ever asked anyone to run a command. If you see this, close the page. If you already ran it, disconnect from the internet, run a security scan, and change your passwords from a different device.
Other warning signs:
- A CAPTCHA on a page you reached from an email or SMS link.
- Being asked for a one-time PIN “to verify you are human”. OTPs authorise transactions and logins — never share one with anyone, including someone claiming to be from your bank.
- A “download this to continue” prompt.
- A page mimicking a familiar brand on a slightly wrong address.
- Urgency — “verify within 5 minutes or your account is suspended”.
- A CAPTCHA on a site with no reason to have one, such as a static page offering a prize.
Do not use services that solve CAPTCHAs on your behalf. They exist to serve bots, they are frequently bundled with unwanted software, and they may capture what you enter.
If in doubt, leave. Navigate to the organisation directly, by typing the address or using their official app, and see whether the same request appears there.
Related security and verification guides
Frequently asked questions
What is a CAPTCHA used for? Distinguishing humans from automated software, to protect logins, forms, checkouts and sign-ups from bots and spam.
Why do I keep getting CAPTCHAs? Usually because the site cannot gather enough signal about you — a VPN, shared connection, blocked cookies, strict privacy settings or an old browser all trigger more challenges.
How does ticking “I’m not a robot” prove anything? The click itself is not the test. The system analyses how your cursor moved, timing, and browser signals around it.
Can a CAPTCHA ask for my password or OTP? Never. A CAPTCHA does not verify who you are, only that you are human. Anything asking for credentials or a one-time PIN is a scam.
A verification page told me to press Windows+R and paste something. Is that normal? No — that is a known malware scam. Close the page. If you ran it, disconnect, scan for malware, and change your passwords from another device.
What if I genuinely cannot solve it? Try the audio option, allow that site’s cookies, pause any VPN, or use a different browser. On a legitimate site, contact their support.