Get a year of super-useful advice
Solve your tech issues and get expert buying advice whenever you need it, all year for only £49.
Join Which? Tech SupportBy clicking a retailer link you consent to third-party cookies that track your onward journey. This enables W? to receive an affiliate commission if you make a purchase, which supports our mission to be the UK's consumer champion.
How to spot a fake Captcha – and what to do if you fall for one
Cybercriminals use convincing ‘verify you are human’ security checks to trick people into installing malware, but there are signs to look out for
With over a decade of experience at Which?, Tom covers everything from tech advice to money-saving tips, and highlights the best deals during major sales events.
You’ve probably encountered a Captcha while browsing the web, asking you to prove you’re a real person rather than a bot by ticking a box or solving a simple puzzle.
While most Captchas are legitimate, cybercriminals are creating convincing imitations that trick users into installing malware. Instead of asking you to identify traffic lights or type words, they instruct you to use keyboard shortcuts and paste harmful commands into your computer.
Below, we take a closer look at how these scams work, the warning signs to watch for and what to do if you think you’ve fallen for one.
Already a Tech Support member? For more help and 1-2-1 technical advice, including advice on malware and scams, go to our Tech Support online booking tool.
Captchas help websites distinguish real people from automated programs. They can prevent bots from creating large numbers of fake accounts, submitting spam through online forms or repeatedly trying passwords to break into accounts.
You might spot a Captcha when signing in, making a purchase or submitting a form. Although they can be irritating if you're in a rush, completing one is usually a quick and harmless part of using a website.
How does the fake Captcha scam work?
At a glance, a malicious Captcha can look like the real thing. You might see a familiar ‘Verify you are human’ message, or a checkbox asking you to confirm you’re not a robot.
The warning signs appear in the next step. Instead of completing the check in your browser, you’re given instructions to follow on your computer. For example, you might be told to press Windows key + R to open Windows Run, then paste text into the box that appears.
In some cases, the website might have already copied a command to your clipboard. If you follow the instructions and paste it into Windows Run, you could unknowingly run a command that downloads malware onto your computer. Once installed, malware can be used to steal passwords and personal information.
Sadly, these scams aren't limited to suspicious-looking websites. Cybercriminals can compromise legitimate sites and use them to display malicious prompts, so recognising the website doesn't necessarily mean the Captcha is safe.
Discover the best antivirus that will keep you safe from viruses and phishing attacks.
How to spot a fake Captcha
The biggest warning sign is being asked to do something outside your browser, such as opening another program or using a keyboard shortcut to access a Windows tool.
A genuine Captcha will usually ask you to tick a box, select pictures or complete another challenge on the webpage. It shouldn’t ask you to open Windows tools or paste commands into your computer.
Be suspicious if a ‘verify you are human’ check asks you to:
- press Windows key + R or another unusual keyboard shortcut
- open Windows Run, PowerShell or Command Prompt
- copy or paste text or code
- press Enter to run a command.
If you’re asked to do any of these things, don’t continue with the verification. Close the browser tab instead.
What to do if you followed the instructions
Spotted the scam before running the command? Close your browser and don't follow any further instructions.
If you've already followed the instructions in the fake Captcha and run a command, treat your computer as potentially compromised.
- Disconnect your computer from the internet – turn off wi-fi or unplug the Ethernet cable, as this can prevent malware from sending or receiving data.
- Run a malware scan – use your antivirus. If you don't have one installed, on Windows 10 or 11, search for Windows Security, then go to Virus & threat protection > Scan options > Full scan. This checks the files and programs on your computer for threats.
- Don't sign in to important accounts – until you’re confident your computer is clean, don’t use it to access your email, online banking or other important accounts. Some malware is designed to steal passwords and personal information.
- Change your passwords using another device – on a trusted phone, tablet or computer, change the passwords for your most important accounts, starting with your email. Use unique passwords and turn on two-factor authentication (2FA) where it’s available (see also: Apps to secure).
- Check your accounts for suspicious activity – look through your bank accounts and other important services for payments, logins or other activity you don’t recognise. Contact your bank immediately if you spot anything suspicious.
If you’re concerned that malware might be installed on your computer, remember that Which? Tech Support members can get 1-2-1 help from our experts. If you're a Tech member, you can book an appointment with our friendly team.
Signs your computer has been hacked – strange behaviour on your Windows or Mac PC could be more than a glitch, so check our tips to recognise the risks and keep your data safe.
Join Which? Tech Support
Get a year of super-useful advice
Solve your tech issues and get expert buying advice whenever you need it, all year for only £49.
Join Which? Tech SupportWhich? Tech Support can help you keep on top of your home tech. Our experts explain things clearly so that you can resolve issues and feel more confident using your devices.
Get unlimited 1-2-1 expert support:
- By phone Clear guidance on choosing, setting up, using and resolving issues with your home tech devices.
- By email Outline the issue and we’ll email you our answer.
- By remote fix We connect securely from our office to your home computer and resolve issues while you watch.
- In print Which? Tech magazine – six issues a year delivered to your door.
Join Which? Tech Support.
