You've seen them hundreds of times. "Click here to prove you're not a robot." You tick a box, maybe select a few images, and move on with your day. It's one of those things you don't really think about, and that's exactly why this new scam works.
There's a growing number of fake CAPTCHA pages designed to trick people into doing something slightly unusual, but not unusual enough to raise alarm bells in the moment.
Instead of clicking a box or selecting images, the page asks you to confirm you're human by sending a text message. It might already feel a bit odd, but the way it's presented makes it seem like part of a normal verification process. You tap the button, your phone opens a message that's already written, and all you need to do is press send.
Simple, except behind the scenes, that single action can trigger multiple texts to international numbers, sometimes dozens of them.
Each message adds a small charge to your bill, and because those charges don't show up immediately, the connection isn't obvious. A few weeks later, the bill arrives, and by then, the "verification" you completed is long forgotten. That delay is what makes this scam particularly effective.
Some of these fake CAPTCHA pages don't appear out of nowhere. You can be redirected to them through compromised websites or advertising networks. You click something that looks legitimate, land on a page that feels familiar, and follow the instructions without thinking too deeply about it. In some cases, the browser itself behaves in a way that nudges you forward, making it harder to simply go back or exit.
This one doesn't rely on technical knowledge. It relies on habit. Your team is used to seeing CAPTCHAs, they expect and trust them, and when something looks routine, people move quickly.
CAPTCHAs should never ask you to send a text message. If you ever see that, stop, close the page, and don't interact with it further.
Remind your team of this, especially as more of these scams start to appear. A lesson in awareness can save a lot of confusion, and unexpected charges, later.
If you'd like help making sure your team knows what to look out for, and what to avoid, let's talk. Get in touch.
