In June, the FTC issued a consumer alert about fake CAPTCHA screens. They look like the real thing but ask for something no legitimate verification ever will: keyboard commands.
Falling for it means you’re exposed to malware on your computer. Here is how to spot it, and exactly what to do if you already fell for it.
Quick Answer: How Do You Know if a CAPTCHA Is Real?
The Details: How the Scam Works
You land on a compromised or malicious website, perhaps after clicking a search result, an ad, or a link in an email. A verification box appears, often styled to look like the checkbox screens major websites use.
Instead of an image puzzle, it presents numbered “verification steps” telling you to press a few key combinations. The page has silently copied a hidden command to your clipboard.
Here is what those keystrokes actually do.
The first shortcut opens a small window on your computer that runs typed commands directly.
The second pastes the hidden command into it.
Pressing Enter executes it.
In three keystrokes, you have personally launched the scammer’s program.
Once running, the malware moves fast. It harvests saved browser passwords, email logins, banking and brokerage credentials, and anything else it can reach.
Why Your Security Software Misses It
Antivirus tools are good at inspecting downloads. A malicious file arriving from the internet gets scanned, flagged, and often blocked before you can open it. This scam sidesteps that checkpoint because there is no suspicious download to intercept.
From your computer’s point of view, the owner sat down and typed a command, which is normal behavior it is built to allow. The attack targets your trust, not a software flaw, which is why recognizing the pattern matters more than any product you can install.
The best protection rule fits in one sentence: No real CAPTCHA will ever ask you to press keyboard shortcuts or run anything on your device.
If You Already Followed the Fake CAPTCHA Instructions
Don’t panic, and don’t waste time being embarrassed. This scam works on careful people, too. Work through these steps in order:
Disconnect the device from the internet. Turn off Wi-Fi or unplug the network cable. This cuts the malware’s connection to the scammers.
Use a different device for everything that follows. Your phone on cellular data works. The infected computer cannot be trusted yet.
Change your banking and financial passwords first. Bank accounts, credit cards, brokerage and retirement accounts. Money-moving credentials are what these criminals monetize fastest. Turn on two-factor authentication as you go.
Then change your email password. Your email can reset every other account, so it is the master key. Follow with any account that shared a password with a compromised one.
Run a full security scan on the infected computer with updated antivirus software and remove whatever it finds. If you are not confident the machine is clean, a professional cleanup or a full reset is reasonable.
Call your bank’s fraud department and watch your statements. If you believe credentials were stolen, consider a credit freeze with the three bureaus.
Report it at ReportFraud.ftc.gov. Reports are how the FTC tracks and warns about these schemes.
The Conversation Worth Having
This scam spreads because the fake screens look ordinary and the instructions sound official.
There’s no need to explain clipboards or malware to your spouse, your parents, or your adult kids. Again, you only need one sentence: If a “prove you’re human” box ever tells you to press keyboard keys, it is a scam, so close the tab.
It takes ten seconds to explain, so spread the word.
FAQs About the Fake CAPTCHA Scam
I Pressed the Keys but Nothing Seemed to Happen. Am I Safe?
Assume no. This malware is designed to run invisibly, so a blank moment or a briefly flashing window is consistent with a successful infection, not a failed one. Follow the full recovery checklist: Disconnect the device, change financial and email passwords from a separate device, run a complete security scan, and monitor your accounts. A few careful hours now beats discovering drained accounts later.
Why Didn’t My Antivirus Stop It?
Because there was nothing for it to intercept. Antivirus software concentrates on files arriving from the internet, and this scam never downloads one in the usual way. Instead, your own keystrokes execute a command, which your computer treats as a normal action by its owner. Good security software still matters and may catch the malware afterward during a scan, but the primary defense here is recognizing that no real CAPTCHA asks for keystrokes.
