Still getting fake sign-ups with CAPTCHA?
If you still get fake sign-ups with reCAPTCHA or Cloudflare Turnstile switched on, the CAPTCHA is probably doing its job: it answers "is this a person in a real browser?". Many fake accounts pass that test, because a person, or a well-disguised browser, is creating them. Catching them takes signals about the sign-up itself: the email address, the network and how the form was submitted.
Last updated
What a CAPTCHA actually checks
Modern CAPTCHAs mostly run invisibly. They look at the browser session that loads your form and decide whether it behaves like a human visitor, sometimes showing a puzzle when unsure. Either way they answer one narrow question about one session. They don't know whether the email address is a throwaway, whether the same person registered yesterday under a dotted Gmail spelling, or whether the "player" is connecting from a rented server.
Five reasons fake accounts get through anyway
- A human made the account. Bonus abusers and farm workers register by hand. A person passes a human test, every time.
- The challenge was solved for them. Paid solving services and browser extensions return valid tokens for a small fee per solve.
- A real browser was automated. Automation frameworks drive a genuine browser, and a carefully configured one can look human enough to pass.
- The form was skipped. If an account can be created through another route, such as a checkout page, an API endpoint or an older registration URL, the CAPTCHA on the main form never runs.
- The token wasn't checked on the server. A CAPTCHA only works if your server verifies each token with the provider. A missing or skipped server check is a common integration bug.
Quick fixes worth doing today
- Confirm your server verifies the CAPTCHA token on every registration, and rejects requests without one.
- List every place an account can be created on your site and protect each one, not just the sign-up page.
- Look at a sample of recent fake accounts. Same inbox in different spellings? Temp-mail domains? Hosting-company IPs? The pattern tells you which signal is missing.
The signals CAPTCHAs don't look at
| Fake account pattern | Signal that catches it |
|---|---|
| One person, many Gmail spellings | Normalise the address; compare the inbox with earlier sign-ups |
| Throwaway inboxes | Disposable-domain lists plus mail-server matching |
| Generated addresses | A machine-made local part, such as [email protected] |
| Rented servers and VPNs | IP checks for datacenter networks, VPN providers and Tor |
| Borrowed location | Browser time zone versus IP country |
| Scripts posting the form | A browser check (and whether it ran at all), plus the client's own traces |
How InlineShield adds the missing layer
InlineShield screens each registration on your server before the account exists. A small browser script runs on the form and your server sends its result with the sign-up to /api/v1/siteverify; or your server calls /api/v1/verify on its own. The answer checks everything in the table above: Gmail aliases and repeat inboxes, listed and unlisted disposable domains, machine-made addresses, headless browsers, automation frameworks and scripted HTTP clients, VPN, Tor and datacenter IPs, and time-zone mismatches. If the browser script didn't run at all, the answer's reasons say so, and you can switch on a hold for those sign-ups, which then carry the trigger NO_BROWSER_CHECK. You get a verdict, a recommended action and plain reasons, and your CAPTCHA keeps doing its own job alongside.
On WordPress and WooCommerce, the InlineShield plugin screens the registration and My Account forms, and checkout if you switch it on. InlineShield doesn't replace or switch off a CAPTCHA plugin; it looks at different signals. For casinos and sportsbooks, see bonus abuse prevention; for the bot side in detail, bot sign-up detection.
Frequently asked questions
Should I remove my CAPTCHA?
No need. It still stops crude scripts cheaply. Add sign-up screening for the accounts it can't judge.
Is Turnstile better than reCAPTCHA for this?
They answer the same question in different ways. Neither looks at whether the email address or IP address is risky, so the gap is the same.
Does InlineShield show players a puzzle?
No. Screening happens on your server; the player sees nothing unless you decide to hold or refuse the sign-up.
How can I check the addresses I already have?
Try a few in the free disposable email checker and the Gmail alias checker.
Screen your next sign-up for free
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.