I am not a robot' tests were irritating. Now they are dangerous

Captchas have outlived their utility and even been used for scams. Unfortunately, it looks as if we are stuck with them for now.

- Irene Tham

You land on a website that promises movies, music and news articles, or click on a link to join a Telegram channel that promotes cryptocurrency investments. A Captcha prompt pops up, asking you to prove you're not a robot. You probably wouldn't think twice about doing so. But in this case, it is not the usual puzzle asking you to decipher scrambled characters, or select squares with buses, trains or traffic lights. Instead, you are instructed to hold down some keys on your keyboard and follow the "I am not a robot - reCaptcha verification ID: 8253" verification process, or, if the puzzles are too difficult, enter a command to bypass the verification. But here's the catch: By doing so, you would have downloaded malware that can steal passwords, web session cookies and cryptocurrencies.

Cyber security experts have warned about Captcha scam campaigns promoting movies, music or news articles that swept the global Internet in late 2024. Even savvy internet users in a rush or on autopilot can fall prey to the ruse.

In February, the Singapore Police Force and the Cyber Security Agency issued alerts about cryptocurrency investment scams on social media involving the use of Captchas to join Telegram channels.

For many years now, Captcha has been criticised for being effective only at annoying users. But now hackers have completely flipped the script and are using the tool to defraud human users.

Is there a better way to keep bots at bay? Really, should the burden be on humans to prove they are humans?

BOTS ARE TOO SMART FOR CAPTCHA
Captcha — an acronym for "completely automated public Turing test to tell computers and humans apart" — was invented in the late 1990s by a group of researchers at Carnegie Mellon University.