That “Prove You’re Human” Prompt Could Be Silently Charging Your Phone Bill

Most people click through CAPTCHA prompts without a second thought. That instinct — to just check the box and move on — is exactly what a newly uncovered fraud scheme is banking on. Research from Infoblox Threat Intel has revealed a wave of fake CAPTCHA pages that trick users into unknowingly sending international text messages, generating fraudulent charges that end up on the victim’s phone bill while funnelling money to cybercriminals operating in the background.

The scheme taps into a long-established category of telecommunications fraud known as international revenue share fraud, or IRSF. What makes this particular operation notable isn’t the fraud category itself — IRSF has existed for years — but the delivery mechanism. The use of fake CAPTCHAs in this way is a novel attack type for cybercriminals. In these attacks, a user follows instructions that look like a regular CAPTCHA but in reality sends an international SMS, resulting in charges on the victim’s phone bill, with a share of that revenue going to the actor who leases the phone numbers and operates the fake CAPTCHA site.

How It Works — and Why It’s So Hard to Spot

The mechanics are deceptively simple. A user lands on a page — possibly through an ad click, a redirected link, or a compromised website — and is presented with what appears to be a standard verification prompt. They follow the on-screen instruction, not realising that completing the “check” is actually triggering an outbound SMS to an international number. The charge appears on the phone bill, often buried among legitimate usage, and the criminal collects a cut of the revenue generated by that international SMS route.

What makes this operation so effective, according to Dr. Renée Burton, VP of Infoblox Threat Intel, is not just the fake CAPTCHA itself, but the commercial ad and traffic systems wrapped around it. Affiliate-style infrastructure is being repurposed to industrialise phone fraud, while making it very hard for outsiders to see the full picture.

Burton noted that Infoblox had been tracking malicious use of traffic distribution systems for some time, but that directly tying them to a long-running SMS fraud scheme represents a new development in the research team’s findings.

The Cost Isn’t Just Financial

While each individual charge may appear minor in isolation, the cumulative impact is anything but. At scale, this behaviour drives meaningful, recurring losses for carriers and a steady stream of complaints and disputes from confused customers.

Infoblox’s research frames this not only as a cybersecurity problem but as a broader business and trust issue. This type of fraud erodes margins, damages trust in digital services, and invites regulatory scrutiny, with telecom operators, advertisers, and online platforms all needing better visibility and controls over how simple verification prompts and one-click flows convert into real-world charges.

The implication for carriers is particularly uncomfortable. Revenue leakage through IRSF schemes can be difficult to detect in normal billing flows, and when customers eventually notice unexplained charges, the reputational fallout typically lands with the carrier rather than with the scammers who engineered the fraud.

The Bigger Picture

The same systems that route users to content can just as easily route money to criminals — and fake CAPTCHA fraud is already exploiting that gap at scale. For anyone responsible for digital advertising infrastructure, traffic distribution networks, or SMS-based verification flows, that conclusion should prompt a serious review of where those systems lead and who ultimately benefits from the clicks they generate.

The full technical breakdown of the operation, including details of the affiliate infrastructure involved, is available via Infoblox’s threat intelligence blog at infoblox.com.