CAPTCHAs are one of the great annoyances of the modern internet, yet they play an important role in keeping the web secure. These tests, which usually involve solving simple puzzles or deciphering distorted text, help websites determine whether a visitor is human, thus helping prevent malicious bot attacks.
But now scammers are using the ubiquitous test to attack the humans—and if you fall victim to a CAPTCHA scam, all your data could be up for grabs.
What is a CAPTCHA scam?
To understand what a CAPTCHA scam is, you first need to understand what a CAPTCHA is. You’ve certainly seen one even if you don’t know what it was called. A CAPTCHA is that little box that sometimes appears on a web page that asks you to type out text it has purposefully distorted or click images that are all alike in someway—such as ones that feature buses or bridges—displayed in a 3×3 grid.
CAPTCHAs—acronym for “Completely Automated Public Turing test to tell Computers and Humans Apart”—help website owners ensure that a human, and not a bot, is accessing the site’s information. This helps protect against automated scraping and denial-of-service attacks.
The ubiquity of CAPTCHAs has conditioned people to expect them—and that’s enticing to scammers, who now use fake CAPTCHAs to get unsuspecting users to install malicious code on their Macs and PCs, designed to steal their data. Fake CAPTCHAs are becoming so prevalent that the Federal Trade Commission (FTC) released an alert earlier this year warning consumers of the tactic.
How does it work?
The CAPTCHA scam shows a fake CAPTCHA pop-up on a malicious website that looks like the real website for a legitimate company, such as Amazon.com or Facebook.com. But instead of asking you to enter the distorted text you see on screen or solve a simple image puzzle, the fake CAPTCHA tells you to press certain keys on your keyboard, ostensibly to help verify that you are human or to verify your account.
These keystrokes are known as keyboard shortcuts, and by entering them, you copy and paste code that the fake CAPTCHA has added to your clipboard, allowing scammers to automatically download and install malicious software on your phone or laptop.
If you’re on a Windows machine, you may be asked to press Windows+R, then Ctrl+V, on your keyboard. On a Mac, you may be asked to press Command-Space, type in “Terminal,” and then press Command+V. Windows+R opens Windows’ Run launcher. Terminal is the Mac’s equivalent. Both let users enter command-line instructions that can tell the computer to download and install files and apps.
Far from verifying that you are human, the pasted text installs keyloggers or spyware on your device designed to steal your usernames, passwords, and other data, which the scammers then often use to commit financial and other crimes.
How do I know if I am the target of a CAPTCHA scam?
The best way you can know if you are a target of a CAPTCHA scam is by being aware that the scam exists, and by understanding how CAPTCHAs actually work.
Legitimate CAPTCHAs will never ask you to carry out keyboard commands or open any type of app or command line interface on your computer. The second you see a CAPTCHA that asks you to do so—or has a long list of instructions—beware. It is a telltale sign that the CAPTCHA is a scam.
Other signs that the CAPTCHA could be a scam? When it pops up unexpectedly and claims to be for a site, like Facebook, that you are not currently on, or appears on a website that clearly isn’t the site it purports to be (like a fake Amazon.com or Apple.com website).
How can I protect myself?
Knowledge is your best defense. As soon as you think you may be being targeted by a CAPTCHA scam, do not interact with the CAPTCHA displayed on your screen.
If you have interacted with a fake CAPTCHA—and especially if you notice that doing so has caused something to download to your computer—the FTC advises you to quickly disconnect your computer from the internet (i.e., shut off its Wi-Fi connection) and immediately run security software to help find and remove any malware.