Scam DetectiveScam website list

Rapid response · fake CAPTCHA

Fake CAPTCHA Scam: What to Do

Published by Scam Detective · Primary source dated

Use the reported pattern as a warning, not as proof about every message or page. Pause, verify independently, and avoid sharing secrets while you check.

What the source reports: The FTC says it received reports of phishing pages made to resemble CAPTCHA checks. In the reported pattern, the prompt tells a Windows user to press Windows + R, paste with Ctrl + V, and press Enter, which can run hidden malware.

Evidence boundary: A CAPTCHA's appearance alone does not prove that a page is malicious. But a prompt that asks you to open a system tool, paste a command, run a script, or install something is not a normal CAPTCHA and is a strong reason to stop.

Primary source: Federal Trade Commission, “How to spot a CAPTCHA scam” (June 8, 2026). Source reviewed September 14, 2026.

Warning signs to check

  • The prompt asks you to use Windows + R, a terminal, PowerShell, or another system tool.
  • It tells you to paste or run a command to prove you are human.
  • A file downloads or a security prompt appears during the check.
  • The page uses urgency or claims your browser must be repaired, updated, or verified.
Do not test a suspicious prompt by interacting with it. A polished logo, familiar sender name, HTTPS padlock, or professional wording is not enough to establish who controls a page.

What to do now

  1. Do not paste or run the command. Close the page without granting permissions.
  2. If you can safely copy the public page URL without reopening it, check that URL—not the command—with the free preview below.
  3. If you ran a command, disconnect that device from the internet and use a different trusted device to secure important accounts.

If you already interacted

  • Run an up-to-date security scan and follow your device or security provider's malware-removal guidance.
  • From a different trusted device, change exposed passwords and enable two-factor authentication, starting with email and financial accounts.
  • Contact your bank promptly if banking credentials or payment information may have been exposed.

Scam Detective does not remove malware, recover funds, contact a sender, or provide emergency, legal, or bank support.

Questions people ask

Can a real CAPTCHA ask me to run a command?

The FTC says real CAPTCHAs use image- or text-based tasks and do not ask you to run commands on your device. Stop if a prompt asks you to paste into Run, PowerShell, a terminal, or another system tool.

Can a URL check tell whether malware was installed?

No. A URL check can review public website signals at a point in time; it cannot inspect your device or confirm whether malware was installed. Use trusted device-security support for that.

Privacy and limits

Use a public website URL only. Never paste passwords, one-time codes, payment details, private invitation links, private document links, message contents, or personal information. Submitted URLs are used to produce the requested result and are not included in analytics events.

A website preview or report is a point-in-time assessment of publicly visible signals, not a guarantee that a site is safe or fraudulent. It cannot verify a person behind a message, inspect your device, or see facts that are not public. Threats and websites can change.

We do not provide continuous monitoring, real-time feeds or an API, takedown execution, fund recovery, or legal advice.