Why Real Users Fail CAPTCHA and Bots Pass It

The numbers flipped

For over two decades CAPTCHA was the default answer to bots: give the visitor a puzzle only a human can solve. That assumption no longer holds. A UC Irvine study that tested CAPTCHAs on popular websites found bots finishing in under a second with 85 to 100 percent accuracy, while humans needed roughly 9 to 15 seconds and got 50 to 84 percent right. The test that was supposed to filter out machines now filters out the slower, less accurate side, and the slower side is us.

The 2024 paper Breaking reCAPTCHAv2 reported solving 100 percent of the reCAPTCHA v2 image challenges it tested with object detection models, against 68 to 71 percent in earlier work. The W3C's note on the inaccessibility of CAPTCHA says image, logic, and audio CAPTCHAs can be largely cracked by both complex and simple algorithms, and that making text harder for OCR makes it harder for people too. Every increase in difficulty lands on the human first.

Meanwhile the bots got a second route that does not need to solve anything. OWASP's OAT-009 definition includes human farms: challenges are relayed to paid workers and the answer is returned to the bot, so the cost per solve is what matters, not the difficulty. A challenge that costs a fraction of a cent to outsource is not a barrier. It is a line item.

Why real users fail

Behavioral analysis is the first reason. Modern CAPTCHA systems evaluate mouse movement, click patterns, and navigation before and during the challenge, and some real users move their mouse quickly, click in unusual patterns, or navigate differently from what the system expects. When that happens the system flags them as suspicious, and the user gets challenge after challenge even though they solved each one.

IP reputation is the second. Many websites monitor traffic from specific addresses, and a visitor on a shared network, a corporate VPN, or a mobile carrier connection inherits the reputation of everyone else on that address. Legitimate users get forced through multiple CAPTCHAs simply because the network they are on has a poor reputation, and there is nothing they can do about it except leave.

Privacy tools are the third. Browser extensions that block trackers can interfere with CAPTCHA verification, because the systems rely on scripts, cookies, and background connections to collect the data they expect. When an extension blocks those elements, the verification cannot complete, and the system assumes the request is automated. The user did not solve the puzzle incorrectly. The verification process never finished.

Stop asking the question

A CAPTCHA raises cost, it does not prove humanity. Treat a pass as one weak signal, not a verdict, and build the defense from signals that do not punish the user: IP and ASN reputation, TLS fingerprints, session behavior, request velocity, and transaction patterns. No single signal establishes intent on its own, and the combination is what makes the decision.

Use risk-based step-up. Passive behavioral signals run while the user does the normal task, with no extra step. Only challenge when the score looks suspicious, and make the challenge something a real person can finish easily, like an emailed code. Most real users never see a challenge at all, which is the entire point: the security is in the background, and the friction lands on the traffic that earned it.

And take the accessibility requirement seriously. WCAG 2.2 success criterion 3.3.8 requires an alternative to cognitive function tests during authentication. A puzzle that locks out people who cannot see or hear the challenge is not just bad security, it is a compliance problem, and it is one that a risk-based approach avoids by design.

Keep reading: Residential proxies: why IP blocking stopped working on its own, Why Is My Traffic Up But Sales Are Flat?.