1. News
  2. Alerts
  3. Scams · CAPTCHA
AlertScams · CAPTCHA2 min read

Fake CAPTCHA tests are being used to steal your data

Scammers are copying the CAPTCHA puzzles you see every day to steal personal data, so a routine click on a familiar test is no longer automatically safe.

By the Dashline deskSource: Fast Company
Fake CAPTCHA tests are being used to steal your data
Photo: Raysonho @ Open Grid Scheduler / Grid Engine, CC0
Act this week
What happenedScammers are using fake CAPTCHA tests, the puzzles that prove you are human, to steal people's data.
Who is affectedAnyone who browses the web, on phones or computers, and sees these tests on websites every day.
What to do
  1. 1Treat any CAPTCHA that asks for more than a simple puzzle or click as suspicious.
  2. 2Never enter passwords, card numbers or personal details into a CAPTCHA box.
  3. 3Close the tab if the test feels odd, and go to the site again by typing its address.
  4. 4If you already followed odd instructions, change your passwords and watch your accounts.

Scammers are now faking CAPTCHA tests, the small puzzles websites use to check that you are a person, in order to steal data. The tests look familiar, and that is the point. Most people click through them without a second thought.

What changed

A real CAPTCHA usually asks you to solve a simple puzzle or read distorted text. Websites use it to tell humans from bots, which helps block malicious bot attacks. Because the tests are so common, people tend to trust them. Scammers are borrowing that trust and copying the look to go after personal information.

Who it affects

Anyone who browses the web, on a phone or a computer, could run into one. These tests show up on websites every day, so a fake one can blend right in. Business owners and their staff are in the same position as everyone else.

What to watch for

The key sign is a test that asks for more than a simple puzzle or click. A real one does not need your passwords, card numbers or personal details. If something feels odd, treat it as suspicious. The alert box above lists the steps to take, including what to do if you already followed strange instructions.

What is not known yet

The source material is brief. It does not say how widespread the scam is, which websites are involved, or exactly what the fake tests ask people to do. Dashline will not guess at those details. The safe habit holds either way: slow down when a website asks for more than a simple puzzle.

The takeaway

A real CAPTCHA never needs your passwords or card details, so if one asks for more than a simple puzzle, close the tab.

More articles

You should really read these.

Next step

Let’s talk