CAPTCHA is a common verification process that many users encounter online. So, it’s not uncommon to click on the verification box without much thought. However, scammers have devised ways to get unsuspecting users to grant them access to their devices or install malware or viruses via a fake CAPTCHA. This article will go into detail about how to spot a fake CAPTCHA scam and what to do if you fall victim to it. Fake CAPTCHA: What Is That? A fake CAPTCHA scam is a pop-up or web page that mimics an “I’m not a robot” security verification. However, instead of simply asking you to check a box, identify letters, numbers, or photos, or listen to audio to confirm you are human, you are prompted to open Run, Terminal, PowerShell, or paste commands into your device. These instructions are designed to trick you into executing harmful code that can install malware, steal data, or compromise your device security. Report a scam How Can You Tell a CAPTCHA Is Fake? The biggest red flag of a fake CAPTCHA is being asked to do something outside of your browser, such as executing commands on your device or changing settings. A user on the Malwarebytes forum reported an incident where their personal computer was infected with a virus or malware after they “…followed the fake CAPTCHA instructions to hit Windows + R and paste a command and ran it….” Below are the warning signs for a fake CAPTCHA: Instructions for using keyboard shortcuts such as Windows+R, Ctrl+V, or Enter to open system tools or to paste and run commands on your device. Prompt to paste a “verification code” into a command prompt, terminal window, or PowerShell. Offers to scan a QR-core. Request to download or run a file as a requirement to complete a verification process. Instructions to disable security tools on your device. Request to update your browser or install an extension. Source: security.duke.edu What Should You Do If You Interacted With a Fake CAPTCHA? If you have interacted with a fake CAPTCHA, you must act quickly to avoid or limit potential damage. Here are the steps to take in order of their priority: Disconnect your device from the internet. You may either turn off the Wi-Fi or disconnect the network cable to prevent malware from sending information to hackers. Run a full security scan on your device. While keeping your device offline, use an up-to-date antivirus to run a full security scan to find and remove any threats. Change all your important passwords. Use a different, safe, and trusted device, such as your phone or another computer, to change passwords for all your important accounts, including your email, social media, and banking accounts. Start by resetting your email password, as hackers can use it to reset and access other accounts. Enable two-factor verification to add another layer of protection for all your important accounts. Monitor your accounts closely. Look out for unusual login alerts, unexpected emails, password reset requests, or changes to your email settings, such as hidden forwarding rules. Also, check your bank and credit card accounts for unauthorized transactions and report any suspicious activity to your financial institution immediately. Steps to Avoid Fake CAPTCHA Scams Follow these practical steps to protect yourself from fake CAPTCHA scams: Do not click on random pop-ups claiming that you need to complete a verification check. Avoid sketchy redirects. Close a page if a CAPTCHA takes you to a different website or outside the browser. Stop immediately if a prompt asks you to use PowerShell, the terminal, or the Run dialog. Do not copy/paste code or use keyboard shortcuts, such as Windows+R, to paste any code provided during a security check into a system tool. Leave a verification page if it asks you to download files, run hidden tools, install extensions, or uninstall or disable security tools. Double-check URLs to ensure that you are visiting a legitimate website. If a CAPTCHA asks you to run code, download a file, use keyboard shortcuts to copy code, or open other programs outside your browser, it is most likely a scam and not a real security check. Stop immediately, close the tab, and disconnect your device from Wi-Fi. Then follow the steps outlined above to secure your device and accounts. Also, report the scam to warn others and prevent them from falling victim to CAPTCHA scams. Report a scam