Captcha & Verification Safety

Discord verification systems are critical for keeping servers safe from bot raids. However, malicious actors often set up fake verification screens to compromise user accounts and infect systems with malware.

This guide goes over how to identify malicious captchas, why you should NEVER run commands to verify, and how to tell real captchas from scams.

🚫 Malicious captcha types

A common and rampent scam that the internet is facing is fake captchas which ask you (the user) to complete actions outside your browser to prove you're human. These are some of the most common type, as of writing:

The "Terminal/Console Command" Scam

Some fake captchas may ask you to open dev tools on your web browser (inspect element, ctrl + shift + i, F12, so on). You should NEVER do this as captchas will NEVER ask you to install anything, run any commands or scripts.

NEVER run any code or commands in your browser console or terminal

Running any command (e.g., beginning with powershell -c ... or curl ... | sh) will likely infect you with infostealer malware on your computer or worse. This can steal:

  • Saved browser passwords and cookies
  • Discord login tokens
  • Cryptocurrency wallets
  • Files and browser history

EXAMPLE OF A FAKE CAPTCHA

Fake Captcha Scam Example

NEVER RUN COMMANDS IN YOUR BROWSER CONSOLE OR TERMINAL

What is a terminal?

Here, we define terminal as any command interface on your device, such as:

  • Command Prompt
  • Powershell
  • BASH
  • Browsers console

🔍 How to Identify Real vs. Fake Captchas

Use the following check list to determine if a verification prompt is genuine:

Feature🛡️ Real Captcha❌ Fake Captcha (Scam)
User ActionClick a button, solve a puzzle, so onCopy paste a command or script, open dev tools, install an program or browser extension
External SoftwareNone.Requests downloading an .exe, .dmg, or installer package or browser extension
Browser ConsoleNo console or installer used, simple puzzleRequires you to open the console (F12 or CTRL+SHIFT+I)

Visual Examples

Legit Verification Portal

A real verification widget is clean, flat, and only requires simple clicks:

Real Captcha Verification Success

🛡️ Best Security Practices

  1. Never run any commands anywhere: No ligitimate captcha will ask you to install, download, or run any executables, scripts, programs, or run any commands in any terminal
  2. Report malicious websites: If you encounter a Discord bot with a captcha asking you to do any of the above, report it to Discord Trust & Safety. If you encounter a fake captcha outside of Discord (such as you stumble upon one on the internet), you can report them on the Google Safe Browsing Report Page