'Unfortunately, it needs to be said: Do not send a text to confirm you are human': Experts reveal how fake CAPTCHAs are driving a global SMS scam campaign | Tech Radar
Overview
News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Details
Unlock and manage exclusive Techradar member rewards.
Unlock instant access to exclusive member features.
Get full access to premium articles, exclusive features and a growing list of member rewards.
'Unfortunately, it needs to be said: Do not send a text to confirm you are human': Experts reveal how fake CAPTCHAs are driving a global SMS scam campaign
CAPTCHAs asking you to send an SMS are actually a scam
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Infoblox researchers expose long‑running CAPTCHA scam that tricks victims into sending costly international SMS messages
Victims can unknowingly send dozens of texts, incurring charges while attackers profit through telecom revenue sharing
The defense is simple: never send a text message to “prove you are human”
Fake CAPTCHAs are not just about copying and pasting links to malware - they can also be about sending an SMS to an international number and being charged a whole lot for the privilege.
Security researchers from Infoblox recently published an in-depth report about an “underreported” type of CAPTCHA scam.
This particular campaign has been active since at least June 2020 and has been tricking people into sending SMS messages through social engineering and browser back button hijacking. During their research, they found 35 phone numbers in 17 different countries.
Millions of smartphone users could be at risk from the SMS sign-in URL issue - here's what you need to look out for
Ever heard of 'quishing'? Nord VPN warns the future of scams lies in QR codes – and shares some tips on how to stay safe
Hackers hijack Word Press sites to spread malware using fake CAPTCHA
"The fake CAPTCHA has multiple steps, and each message crafted by the site is preconfigured with over a dozen phone numbers, meaning the victim isn't charged for just a single message – they're charged for sending SMSs to over 50 international destinations," researchers David Brunsdon and Darby Wise wrote in their report.
One of the reasons why this sort of scam hasn’t been that widely reported is likely because of delayed billing, they added. International SMS charges are only a problem a few weeks later, when the bill arrives, and by then, “the experience with the fake CAPTCHA has been long forgotten.”
Another vital part of the effort are the malicious traffic distribution systems (TDS), which redirect the victim to these landing pages.
Here is how it works: a commercial TDS redirects a victim to a malicious website that requires the person to “confirm they are human” by sending an SMS. When the victim taps the button, the page uses built-in mobile features to open the SMS app with the number and message already filled in. The numbers are leased by the attackers.
The process then continues, and each subsequent step asks for another “confirmation”, triggering multiple SMS messages to different numbers. In the process, the victims may end up sending as many as 60 SMS messages to 15 different numbers, raking up expenses of up to $30. It may not sound like much, but this is a game of large numbers - with thousands of users falling victim, the figures quickly add up.
The victims in this campaign are both the end users and the telecoms, Infoblox concluded. Users, for obvious reasons, and telecoms - by paying revenue share to the perpetrators, as well as by sorting out chargebacks and customer refund requests.
Defending against the scam is simple, however. “Unfortunately, it needs to be said,” Infoblox stressed. “Do not send a text to confirm you are human.”
➡️ Read our full guide to the best antivirus
- Best overall: Bitdefender Total Security
- Best for families: Norton 360 with Life Lock
- Best for mobile: Mc Afee Mobile Security
Follow Tech Radar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, Io T, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
1'Unfortunately, it needs to be said: Do not send a text to confirm you are human': Experts reveal how fake CAPTCHAs are driving a global SMS scam campaign
2 Can any TV beat this one for value right now? The TCL QM6K is a 75-inch mini-LED that 'punches above its weight' — and it's only $680
3I’m a PC gamer of over 30 years, and the Valve Steam Controller (2026) is now one of my favorite gamepads since Sega dropped out of the console wars
4‘Every label in the world is delivering AI’: Apple Music executive says over a third of uploads are ‘100% AI’ as it clamps down on AI fraud
5 James Gunn cautiously reveals that 2 beleaguered DC comic book shows are still 'in development' — but the DCU's biggest movie gamble has been shelved
Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.
© Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.
Key Takeaways
- News, deals, reviews, guides and more on the newest computing gadgets
- Start exploring exclusive deals, expert advice and more
- Unlock and manage exclusive Techradar member rewards
- Unlock instant access to exclusive member features
- Get full access to premium articles, exclusive features and a growing list of member rewards
