Fake human-verification requests
A Page Says to Paste a Command to Prove You’re Human
A web page says to prove you are human by opening another window, pasting something and running it. Stop there. Do not paste or run anything it gives you. A check that you are human does not need you to run a command on your computer.
The page may call this a security check or a CAPTCHA. It may name Windows Run, PowerShell or Terminal, or the Mac’s Terminal. Those are places where written instructions can make the computer do things. Scammers use this request to get people to run software that can steal passwords and other information.
What to do with the page
Close the page using the X on its browser tab, outside the web page. Do not use a button drawn inside the page, and do not follow its instructions to open another program. If the page fills the screen or will not close, use the closing steps for your computer: Microsoft Edge on Windows 11 or Safari on a Mac.
If you already opened Run, PowerShell or Terminal because the page asked, close that window with its X or, on a Mac, its red close button. Do not paste anything into it or press Enter or Return in it.
Closing the page finishes the action you need to take when you have only seen the request. You do not need to complete its check.
If you already pasted or ran the command
Stop using that computer for email, banking or passwords. Do this even if nothing appeared to happen.
- Turn off the computer. On Windows 11, click Start (the Windows logo at the bottom of the screen), click Power (a circle with a short line at the top), then click Shut down. On a Mac, click the Apple logo at the top left of the screen, click Shut Down, then click Shut Down in the confirmation window. Unsaved work may be lost.
- Before using it again, contact the computer’s maker for a security check. Use a phone number on your receipt or packaging, or use another device to open Microsoft Support for Windows or Apple Support for a Mac. Tell them that a website told you to paste and run a command, and what you did. Do not contact a number or service from that page.
- On another device, change your email and bank passwords through the apps or websites you normally use. Change passwords for other accounts whose passwords were saved on that computer, too. If you gave card or bank details or sent money, also call the bank or card company using the number on your card or statement.
If you do not have another device, keep this computer off and use the support number on your receipt or packaging before signing in again.
Read the FTC’s alert about fake CAPTCHA requests. You can report the page at ReportFraud.ftc.gov.