You have seen a CAPTCHA hundreds of times. Tick a box, maybe pick out a few traffic lights, prove you are not a robot and move on with your day. It is such a routine part of the internet that nobody thinks about it, and that is exactly why this scam works.
Hi, I am Andy from Initial IT in Lichfield. We look after cyber security for small businesses across Staffordshire and the West Midlands, and this one is worth two minutes with your team, because it does not target technology. It targets habit.
Key takeaways
- Fake CAPTCHA pages ask you to “verify you are human” by sending a text message. Real CAPTCHAs never do that.
- Tapping the button opens a pre-written text on your phone. Sending it can trigger charges to premium-rate international numbers, sometimes dozens of messages from one tap.
- The charges surface on your bill weeks later, so almost nobody connects them to the “verification” they completed.
- These pages arrive through compromised websites and dodgy advertising networks, so they can appear mid-browse on otherwise normal journeys.
- The rule for your team: a CAPTCHA that asks you to send a text is fake, every time. Close the page.
What is the fake CAPTCHA scam, and how does it work?
Instead of the usual tick-box, the fake page asks you to confirm you are human by sending a text message. That should feel odd, but the page is dressed up to look like a normal verification step, and busy people follow instructions that look routine.
You tap the button, your phone opens a message that is already written for you, and all you have to do is press send. Behind the scenes, that single action can fire off multiple texts to premium-rate international numbers. In some cases, dozens of them, each one adding a charge to your bill.
Why do the charges go unnoticed for weeks?
Because nothing visibly bad happens. There is no locked screen, no ransom note, no virus warning. You complete the “verification”, carry on with your day, and the charges quietly land on next month’s phone bill.
By the time the bill arrives, you have long forgotten the CAPTCHA. That delay is what makes this scam effective: the cause and the cost are weeks apart, so most people never connect them, and plenty never spot the charges at all.
How do these pages reach your team in the first place?
Some of these pages do not wait for you to find them. You can be redirected to one through a compromised website or a poisoned advertising network, in the middle of what feels like a perfectly normal browse. You click something that looks legitimate, land somewhere that feels familiar, and follow the instructions.
Some of the pages even lean on the browser to nudge you forward, making it awkward to just go back or close the tab. None of it needs technical skill from the attacker. It relies entirely on the fact that your team sees CAPTCHAs every day and trusts them.
What should your team do instead?
Give everyone one rule: a CAPTCHA will never ask you to send a text message. If a verification page asks for that, it is fake. Stop, close the page, and do not interact with it further. If it happened on a work device, mention it to whoever handles your IT so it can be checked.
Then stack the odds in your favour. Web filtering catches many of these pages before anyone sees them, and short, regular awareness sessions keep habits sharp. The National Cyber Security Centre has free guidance on reporting scam pages, and this filtering and training mix is exactly what we set up through our cyber security and IT support for firms across Lichfield and the West Midlands.
Quick check: where does your business stand on cyber security?
The questions in our free 2-minute Cyber Security Health Check are the eleven we ask every new client first. Score yourself, see the per-category breakdown, and get the three highest-impact fixes for your specific gaps. No marketing list.
Take the 2-minute Cyber Security Health Check
If you are not completely confident your team would spot something like this, that is worth fixing before it is tested for real. We would far rather have a quiet word now than a difficult one later.
Frequently asked questions
What is a real CAPTCHA allowed to ask me to do?
Tick a box, type distorted characters, or pick matching images. All of it happens inside the web page. The moment a “verification” step asks you to do something outside the page, like send a text message or install something, it is a scam.
Someone on the team already sent one of these texts. What now?
Contact your mobile provider straight away, explain it was a premium-rate scam, and ask them to block further charges and premium-rate services on that number. Check recent bills for charges you do not recognise. Then let your IT support provider know so the device and browser can be checked.
Will our security software block fake CAPTCHA pages?
Good web filtering blocks many of them, but new pages appear constantly, so do not rely on filtering alone. The habit is the reliable layer: a CAPTCHA that asks for a text is fake, no exceptions. Filtering plus that one rule covers you well.
How do we train the team on this without scaring them?
Keep it short and specific. This is a two-minute item in a team meeting: here is the scam, here is the one rule, here is who to tell. Little and often beats an annual lecture, and specific examples like this one stick far better than general warnings.
– Andy Price, Founder & MD, Initial IT · 01543 524 594 · hello@initialit.co.uk