Rubens Perdomo
You've seen them hundreds of times. "Click here to prove you're not a robot."
It's a now commonplace staple in the modern internet. You tick a box, maybe spend a few seconds clicking on traffic lights or fire hydrants, and move on with your day without giving it a second thought. CAPTCHAs have become such a routine part of browsing that most people complete them on autopilot.
That routine is exactly what scammers are working to capitalize on.
A Familiar Face With an Unfamiliar Ask
A growing number of fake CAPTCHA pages are appearing online, and they're designed with one specific goal in mind: to trick people into taking a single, seemingly harmless action that costs them money without them ever realising what happened.
These pages look convincing. They borrow the visual language of legitimate verification systems the clean layouts, the familiar prompts, the reassuring sense that this is just a standard security step standing between you and wherever you were trying to go. But instead of asking you to tick a box or identify objects in a grid of images, these fake CAPTCHAs ask you to verify you're human by sending a text message.
That request might give you a moment's pause if you read it carefully. But the way it's presented softens any instinctive suspicion. The language is calm and instructional, the design looks professional, and there's a button to that when you tap it, your phone's messaging app opens with a pre-written message already loaded and ready to go. All you have to do is press send. and most people take it with the thought that it's simply another part of the process.
What's Actually Happening Behind the Scenes
That single tap is where the damage is done.
Behind the scenes, pressing send doesn't complete a verification. It triggers a series of outbound text messages to premium-rate or international numbers, in some cases, dozens of them sent in rapid succession. Each one carries a small charge. Individually, those charges are minor enough to go unnoticed but can add up to a meaningful sum on your phone bill. collectively.
The scam is engineered around a deliberate time delay. Those charges don't appear immediately. They surface weeks later, buried in a phone bill that most people scan quickly rather than scrutinise line by line. By the time the unexpected charges appear, the connection to that verification page you completed three weeks ago is long gone from your memory. There's no obvious moment of realisation. No clear cause and effect. Just a bill that's higher than it should be and no obvious explanation for why.
That delay is what makes this scam particularly effective and particularly difficult to act on once it's happened. Without knowing what to look for, most people will simply pay the bill and assume there's been some kind of error, never identifying the source.
How People End Up on These Pages
One of the most concerning aspects of this scam is that you don't have to be doing anything careless to encounter it. These fake CAPTCHA pages don't always announce themselves. In many cases, people are redirected to them without warning.
You might click a link in a search result that looks entirely legitimate. You might follow an advertisement from a trusted-looking source. You might be browsing a website that has been quietly compromised, where the underlying code has been altered by attackers to redirect certain visitors without the site owner's knowledge. Reputable websites can become unwitting delivery mechanisms for this kind of redirect, which makes it even harder to spot in the moment.
When you arrive on the fake CAPTCHA page, nothing about it signals danger. It looks like the kind of page you've seen before. It behaves like the kind of page you've seen before. In some cases, the browser itself creates additional friction, making it harder to simply click back or navigate away, which subtly increases the pressure to complete the step in front of you rather than exit and think twice.
This is a scam built around familiarity, not technical trickery. It doesn't exploit a vulnerability in your software. It exploits a pattern of behaviour that's been reinforced thousands of times across your everyday internet use.
Why Your Team Is Particularly Vulnerable
For businesses, this isn't just a personal risk, it's also a team risk as well.
Your staff encounter CAPTCHAs regularly as part of their working day. Accessing platforms, submitting forms, logging into tools, navigating websites. These verification prompts are woven into normal workflows. Employees are conditioned to treat them as routine security steps, something to complete quickly and move past rather than something to analyse carefully.
That habit is entirely understandable. It's also precisely what this scam relies on.
When something looks routine, people move at their normal pace. They don't stop to question it. And in a busy working environment, where there are emails to reply to and tasks to complete, pausing to scrutinise a standard-looking verification step isn't instinctive behaviour for most people.
The risk isn't limited to personal phone bills either. If employees are completing these fake CAPTCHAs on work devices, the charges and any associated data exposure become a business problem, one that may be difficult to detect quickly and even more difficult to trace after the fact.
Awareness Is The Most Effective Defence
No software patch or security tool will eliminate this risk entirely, because the attack isn't targeting your technology, it's targeting the habits and assumptions of the people using it. That means awareness is your most powerful line of defence.
Taking a few minutes to brief your team on this scam could prevent a significant amount of confusion, frustration, and unexpected cost down the line. Make it part of a broader conversation about the kinds of online threats that rely on habit rather than technical vulnerability, because these social engineering tactics are becoming increasingly sophisticated, and they tend to evolve faster than people's instincts.
The businesses that protect themselves best aren't always those with the most advanced technology. They're the ones where staff know what to watch for, feel confident enough to pause and question something that doesn't feel right, and understand that slowing down for a moment is always worth it when something seems off.
Let's Make Sure Your Team Is Ready
If you'd like help making sure your team knows how to recognise these kinds of threats, and what to do when they encounter them, we're here to help. Security awareness training doesn't have to be complicated or time-consuming. A focused, practical session can make a real difference to how confidently your people respond to the kinds of scams that are becoming increasingly common.
Get in touch today and let's talk about how we can help protect your business from the threats that target people, not just technology.
