06/25/2026
The Federal Trade Commission (FTC) is warning about a new phishing scam that disguises itself as a CAPTCHA verification.
Most of us are familiar with legitimate CAPTCHAs that ask you to identify images, match objects, or type letters and numbers to prove you’re not a robot. However, scammers are now using fake CAPTCHA screens to trick people into installing malware on their own devices.
How the scam works:
You’re browsing a website and get a CAPTCHA pop-up. It looks legitimate and says, “security verification” or “prove you’re human.” Instead of a normal task, it instructs you to enter keyboard commands like Windows + R, then Ctrl +V, then Enter. This is not a real CAPTCHA, and these steps can install malware on your device and give scammers access to personal information such as passwords, email accounts, and banking details.
Real CAPTCHAs will NEVER ask you to run commands on your device.
If you think you interacted with one:
• Disconnect from the internet
• Run a security scan
• Change your passwords
• Enable two-factor authentication
You can report suspicious activity at ReportFraud.ftc.gov. ML204/FL090