You’ve seen them hundreds of times.
“Click here to prove you’re not a robot.”
It’s one of those things you don’t really think about.
You tick a box, maybe select a few images, and move on with your day.
That’s why this new scam works.
There’s a growing number of fake CAPTCHA pages designed to trick people into doing something slightly unusual… but not unusual enough to raise alarm bells in the moment.
Instead of clicking a box or selecting images, the page asks you to confirm you’re human by sending a text message.
That might already feel a bit odd, but the way it’s presented makes it seem like part of a normal verification process.
You tap the button, your phone opens a message that’s already written, and all you need to do is press send.
Simple.
Except behind the scenes, that single action can trigger multiple texts to international numbers.
In some cases, dozens of them.
Each one adds a small charge to your bill, and because those charges don’t show up immediately, the connection isn’t obvious.
A few weeks later, the bill arrives… and by then, you’ve probably forgotten all about the “verification” you completed.
That delay is what makes this scam particularly effective.
There’s another layer to it as well.
Some of these fake CAPTCHA pages don’t appear out of nowhere. You can be redirected to them through compromised websites or advertising networks.
You click something that looks legitimate, land on a page that feels familiar, and follow the instructions without thinking too deeply about it.
In some cases, even the browser behaves in a way that nudges you forward, making it harder to simply go back or exit.
This one doesn’t rely on technical knowledge; it relies on habit.
Your team is used to seeing CAPTCHAs. They expect and trust them.
And when something looks routine, people move quickly.
But remember this: CAPTCHAs should never ask you to send a text message.
If you ever see that, stop. Close the page and don’t interact with it further.
And remind your team of this, especially as more of these scams start to appear.
A lesson in awareness can save a lot of confusion (and unexpected charges) later.
If you’d like help making sure your team knows what to look out for (and what to avoid), let’s talk. Get in touch.
