You’ve seen them hundreds of times.
“Click here to prove you’re not a robot.”
CAPTCHAs have become such a normal part of browsing the internet that most people barely think about them. You tick a box, select a few images, and move on with your day.
That’s exactly why a new type of fake CAPTCHA scam can be so effective.
How the Fake CAPTCHA Scam Works
Fake CAPTCHA pages are becoming more common, designed to trick people into doing something slightly unusual, but not unusual enough to immediately raise alarm bells. Security researchers at Infoblox have documented a campaign that uses fake CAPTCHA pages to trick users into sending international text messages, potentially resulting in unexpected charges.
Instead of asking you to click a box or identify images, the page may ask you to confirm that you’re human by sending a text message.
That might seem strange, but the page is often designed to look like a legitimate security or verification process.
You tap a button, your phone opens a text message that’s already been prepared, and all you have to do is press Send.
Simple.
Except that one action can potentially trigger multiple text messages to international numbers.
In some cases, dozens of messages may be sent.
Each message can result in a charge on your phone bill. Because those charges may not appear immediately, it can be difficult to connect them to the CAPTCHA verification you completed. The Federal Communications Commission provides consumer guidance on unwanted text messages and texting-related scams.
By the time your bill arrives weeks later, you may have completely forgotten about the website that started it.
That delay is one reason this type of text message scam can be particularly effective.
How You Can End Up on a Fake CAPTCHA Page
These fake CAPTCHA pages don’t necessarily appear out of nowhere.
You may be redirected to one through a compromised website, a malicious advertisement, or a compromised advertising network.
You click something that looks legitimate, land on a page that appears familiar, and follow the instructions without giving it much thought.
In some cases, the browser may even behave in a way that encourages you to continue, making it more difficult to simply go back or close the page.
The scam doesn’t depend on technical knowledge.
It depends on habit and trust.
Why CAPTCHA Scams Work
Your employees are used to seeing CAPTCHAs.
They expect them. They recognize the familiar design. And because CAPTCHAs are normally harmless, people tend to complete them quickly without stopping to question what they’re being asked to do. That creates an opportunity for scammers.
When something looks routine, people are less likely to slow down and examine the instructions carefully.
This is an important cybersecurity lesson: something looking familiar doesn’t necessarily mean it’s legitimate. This is one reason employee cybersecurity awareness training is so important.
A CAPTCHA Should Never Ask You to Send a Text
Here’s the most important thing to remember:
A legitimate CAPTCHA should not require you to send a text message to verify that you’re human.
If a CAPTCHA page asks you to open your phone’s messaging app and send a text, stop.
Do not send the message.
Close the browser tab and avoid interacting with the page any further.
It’s also worth reminding your employees about this type of scam. A few minutes of cybersecurity awareness training can help prevent an employee from unknowingly triggering unexpected charges or falling victim to a more serious attack.
Help Your Team Recognize Online Scams
Cybercriminals don’t always need sophisticated technology to get around your business’s security.
Sometimes, they simply need someone to click a button without thinking twice.
That’s why cybersecurity awareness is an important part of protecting your business. Teaching your team what suspicious websites, fake CAPTCHA pages, phishing attempts, and other scams look like can prevent a small mistake from becoming a bigger problem.
If you’d like help improving your team’s cybersecurity awareness or making sure your business has the right protections in place, Cyberworks can help. Get in touch with us today.
