You’ve probably completed an “I’m not a robot” check hundreds of times.
Tick a box. Select a few images. Prove you’re human. Then get on with your day.
CAPTCHAs have become such a familiar part of being online that most of us barely think about them anymore.
And that’s exactly what scammers are counting on.
Cyber criminals are increasingly taking advantage of familiar online behaviours to make scams feel legitimate. One example is a fake CAPTCHA that looks like an ordinary verification step but asks you to do something a genuine CAPTCHA shouldn’t: send a text message.
You may arrive on what appears to be a normal verification page after clicking a link, visiting a compromised website or being redirected through an advertising network.
Instead of simply ticking a box or selecting images, the page asks you to verify that you’re human by sending a text message.
Your phone may even open the message for you, already written and ready to send.
It seems simple enough.
But behind the scenes, that single action can trigger multiple messages to international numbers. In some cases, dozens of texts may be sent, each adding a small charge to your mobile bill.
The charges might not be obvious straight away.
By the time the next bill arrives, you may have completely forgotten about the verification page you interacted with weeks earlier.
The clever part isn’t necessarily the technology.
It’s the familiarity.
People are accustomed to seeing CAPTCHAs online and generally trust them as a routine security check. When something looks familiar, we’re more likely to follow the instructions quickly without stopping to question whether they’re legitimate.
That’s particularly important in a workplace, where people are often moving between emails, websites, cloud applications and online services throughout the day.
When everyone is busy, an unusual instruction wrapped inside a familiar process can be easy to miss.
A CAPTCHA should never ask you to send a text message.
If a verification page asks you to send an SMS, stop.
Don’t send the message, don’t continue interacting with the page and close it.
If you’re using a work device or you’re unsure whether the website may have been compromised, report it to your IT team so they can investigate.
Technology plays an important role in protecting your business, but your people are another critical layer of defence.
Scams continue to evolve because attackers understand human behaviour. They know people are busy. They know which online processes we trust. And they know that something familiar is less likely to make us stop and question what we’re seeing.
That’s why regular cyber security awareness matters.
Helping your team recognise unusual requests, pause before taking action and know when to report something suspicious can prevent a simple mistake from becoming a much bigger problem.
