'Unfortunately, it needs to be said: Do not send a text to confirm you are human': Experts reveal how fake CAPTCHAs are driving a global SMS scam campaign

• Infoblox researchers expose long‑running CAPTCHA scam that tricks victims into sending costly international SMS messages
• Victims can unknowingly send dozens of texts, incurring charges while attackers profit through telecom revenue sharing
• The defense is simple: never send a text message to “prove you are human”

Fake CAPTCHAs are not just about copying and pasting links to malware - they can also be about sending an SMS to an international number and being charged a whole lot for the privilege.

Security researchers from Infoblox recently published an in-depth report about an “underreported” type of CAPTCHA scam.

This particular campaign has been active since at least June 2020 and has been tricking people into sending SMS messages through social engineering and browser back button hijacking. During their research, they found 35 phone numbers in 17 different countries.

Article continues below