A captcha farm pays people to solve human tests on behalf of automated operators, turning a challenge meant for the visitor into paid piecework.
The solving hands are real, while the surrounding sessions, targets, and profits usually belong to someone the solver never meets.
How it works
Operators route challenges from many sites to a queue of workers who type or tap answers for a small fee.
The visitor experience on the target site can look successful even though the person who passed the test has no relationship with that account or that purchase.
Farms raise difficult questions about labor conditions as well as fraud.
For defense, the important point is that a correct answer no longer proves the account holder is present, so later actions still need identity, payment, and behavior checks.
Concrete examples
- A worker solves a stream of image tests all afternoon, and each answer unlocks a session on a store the worker has never shopped.
- Solve times cluster just above the minimum a person needs, unlike an instant script and unlike a shopper who pauses to read.
- The same worker patterns appear across several merchants in one day because one queue feeds many campaigns.
Protective measures
- Do not treat a solved human test as proof that the real customer is present for the payment or the account change.
- Add step up checks on the action after the test, especially new payees, bulk orders, and password changes.
- Look for solve timing and reuse patterns that fit piecework rather than a shopper reading the page.
- Review labor and abuse reports about solving queues as context for fraud trends, without trying to join or use them.
How CDPCaptcha helps
Browser proof of work raises the cost of farmed solving because the automated client must still spend computation before a person can finish the task.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.