Close a supposed CAPTCHA that asks you to execute a system command, install a program or expose wallet recovery material. Those actions are not a normal human-verification task. If you already followed the instructions, identify what you actually did and contain the possible device compromise before entering another password or wallet backup on that device.
The warning is the requested action, not the artwork
A fake verification page can imitate a familiar security brand or appear over a website you expected to trust. Its logo does not explain why your operating system should execute instructions from a web page. The FTC's CAPTCHA-scam warning distinguishes ordinary browser challenges from requests to run commands that can install malware.
Security researchers call a common version of this manipulation ClickFix: the visitor is persuaded to perform the action that launches the malicious code. Microsoft's investigation documents the technique and information-stealing payloads. The practical response does not require reproducing the command or testing whether it works. Stop at the request that crosses from web verification into system execution.
Write down the stage you reached
Saw the page, clicked a button, copied text, executed something and typed a recovery phrase are different events. Explain the actual sequence to verified support without guessing. Copying text is not, by itself, proof that it executed; closing a page after executing code is not proof that the device is clean. The uncertainty should guide the next check rather than a reassuring message from the same page.
| What happened | What remains uncertain | Immediate practical response | What not to conclude |
|---|---|---|---|
| You saw the verification request | Whether the page changed anything beyond its display | Stop interacting and preserve the URL and time | A familiar logo makes the next command safe |
| You clicked or copied content | Whether anything was downloaded or executed | Do not paste it into system tools; inspect through trusted guidance | Copying alone proves either infection or complete safety |
| You ran the requested instruction | What code and permissions were involved | Contain the device and seek verified security help | Closing the tab reverses the execution |
| You installed software or an extension | Its access and whether it remains active | Treat device and browser access as part of the incident | Removing a visible shortcut revokes every session |
| You disclosed a wallet backup | What access the exposed secret enables | Protect the affected assets through a trusted clean setup | A new local password makes the old secret private again |
| You entered exchange or email credentials | Whether sessions or account settings were accessed | Review access and change affected credentials from a different trusted device | The wallet application is the only account at risk |
This table is a triage aid, not a remote diagnosis of your device. The right response depends on what executed and what was exposed. Keep screenshots and the timing of your actions, but avoid copying suspicious command text into public posts or another execution window while trying to explain it. A security professional can collect evidence through an appropriate channel.
Contain first, then restore access through a trusted environment
The FTC recommends disconnecting an affected device from the internet, using security scanning and changing affected passwords from a different device. Follow verified operating-system or security-provider guidance for your system. ESET's fake-CAPTCHA response guide also distinguishes the actions a person took before recommending what to do next.
For a work-managed device, involve the organization's security team rather than trying to conceal the event with an improvised cleanup. Avoid entering a fresh wallet backup into the environment you are still investigating. If a remote-access tool was installed, include that access in the incident report; a browser symptom can be only one visible part of a broader compromise.
A clean scan is useful evidence, but do not use it as a universal promise that no secret was copied earlier. Device remediation and protection of an already exposed account are separate tasks. Preserve the distinction when deciding which sessions, credentials or wallet recovery arrangements need attention. The absence of immediate outgoing transactions does not establish that stolen credentials were never obtained.
Wallet keys are not ordinary website passwords
A recovery phrase can enable account access independently of the local wallet application's password. If the phrase was exposed, changing that password does not rewrite the phrase. Use verified wallet incident guidance and a trusted environment to protect your legitimate assets. Do not send another person the backup so they can check whether it was stolen; that would create another disclosure.
The seed-storage guide explains why recovery material should not be placed in ordinary online documents and messages. This incident also calls for checking connected services if their credentials or sessions were available on the device. Do not assume a hardware wallet makes every subsequent approval harmless: read the actual action on the trusted signer before authorizing it.
Reject the follow-up fix from the same unverified channel
A page that caused the problem may offer a cleaner, wallet validator or support contact to solve it. That is another claim from an untrusted source. Obtain genuine security tools and support channels independently. Someone repeating your balance, device name or public address has not proved that they are your wallet provider or can recover money.
Be especially wary of a cleanup that asks for a new spending approval, backup phrase or transfer fee. Those requests do not follow from the need to inspect a browser event. The fake-wallet-app guide provides context for verifying software sources. Installing another unknown program is not a reliable way to establish the first program's trustworthiness.
A record that helps a real investigation
- The page's URL and the time you encountered it, without revisiting it to repeat the process.
- Which actions you actually completed: viewing, clicking, copying, installing, executing or entering credentials.
- The affected device and browser, plus any remote access or extension you authorized.
- Which accounts or wallet secrets may have been exposed, described without including the secrets themselves.
- Relevant account alerts and transaction references, kept separate from assumptions about what caused them.
- The containment and verified support actions already taken, so the next helper does not repeat or undo them.
Before preparing a later no-account swap, use a receiving and signing setup you have verified after the incident. Do not make a new order a test of whether unknown software still has access. First establish the state of the device and the keys involved; then verify each new transaction through its actual instructions and trusted signing process.
FAQ
What is a fake CAPTCHA scam?
It imitates a normal verification challenge while persuading you to perform an unsafe action, such as executing system instructions. A convincing security logo does not make that request part of ordinary human verification.
Why do fake CAPTCHA prompts ask me to copy something?
The copied content can be part of an attempt to make you run code yourself. Do not paste it into a system tool to investigate; explain what happened through verified security support.
Should I follow a fake-CAPTCHA fix posted on Reddit?
A forum post can help describe a problem, but an unknown script or download needs independent verification. Use genuine operating-system, security-provider and wallet guidance rather than granting access to another unverified helper.