Fake “I’m Not a Robot” Checks on Crypto Faucets: FaucetPay Phishing and ClickFix Malware

Crypto faucets, the websites and bots that hand out tiny amounts of coins for simple tasks, have long relied on one pattern: you collect small amounts, then withdraw them to a micro-wallet, most often FaucetPay. Since all the earnings end up in one place, scammers have focused on that place. More and more often they target not the faucet itself, but your wallet account and your computer.

Two scams hiding behind one "I'm not a robot" box

Fake CAPTCHAs come in two main forms. Both look like the verification step you already click through every day, and both use it as bait.

Fake FaucetPay pages that wait for your login

According to user reports, in May 2026 sites appeared that impersonated FaucetPay. They promised a daily claim in a cryptocurrency, and their look was a copy of the real service's homepage. At some point they displayed a "verification that you are not a robot" and that you are a genuine account holder. After users completed it, as victims describe, the funds in their account disappeared.

The CAPTCHA here is only the bait. The real goal is what happens in the background: a login on a fake page, an authorisation you do not understand, or data you type in that the attacker captures.

Fake CAPTCHAs that make you run a command (ClickFix)

The second form is better documented. Security researchers and university IT teams describe pages that show a "Verify you are human" box and then add an extra step. The page quietly copies a command to your clipboard and tells you to open the Windows Run window (Win + R) or PowerShell, paste it and press Enter. That command installs information-stealing malware, which can collect saved passwords, browser cookies and session data, and crypto wallet information from your computer. Researchers call this technique ClickFix.

These pages can appear on ordinary websites, through ads or compromised content, not only on shady ones. That is why faucets, with their heavy advertising, are such fertile ground.

Why a CAPTCHA makes good bait

Faucet users are used to annoying security checks. Admins keep introducing more intrusive CAPTCHAs because they are fighting bots and multi-account farms. As a result, a new, strange verification surprises nobody, which makes the scammers' job easier. Someone who is complaining about yet another puzzle rarely stops to check whether it is a real one.

How a real CAPTCHA differs from a scam

A real anti-bot check verifies that you are a human. It does not need your wallet password, a code from your authenticator app, permission to connect accounts, or anything to be pasted into your computer.

Stop if the verification:

• asks you to log in to FaucetPay or another wallet,
• asks for a password, a 2FA code or a recovery phrase,
• requires you to approve connecting an app to your account,
• tells you to press Win + R, open PowerShell or Terminal, or paste anything,
• asks you to download a file or scan a QR code to "finish verification",
• opens on an address that only resembles the real one (a different ending, extra words, a typo),
• appears after you click an ad or a link from a chat, instead of on a site you opened yourself.

A normal CAPTCHA is a click, a tick box or a simple puzzle, and nothing more.

How to protect yourself

• Open your wallet only through your own bookmark. Save the real FaucetPay address in your bookmarks and log in only through it, never through links from faucets, ads or chats.
• Give a faucet only your address. An honest faucet asks for a withdrawal address, not for a password.
• Never paste commands from a website. If a page tells you to copy something and run it, close the tab. This is not how human verification works.
• Turn on extra login protection if the service offers it, and never type a code from your app on a page you reached through a faucet.
• Keep only small amounts in the wallet. The less time funds sit in a micro-wallet, the less can be lost. Withdraw regularly to an exchange or your own wallet.
• Check the address before every login, especially after a redirect.
• Check unfamiliar tokens before you touch them. Faucets and "reward" pages sometimes push unknown tokens or contract addresses, and a quick check with a token scanner before you connect a wallet or approve anything can save you from a drainer.
• Keep your system and browser updated, and use a reputable security tool on the computer you use for crypto.

What to do if you already clicked

If you entered your details on a suspicious page, immediately change the password for your wallet and for the email address linked to it, log out other sessions if the service allows it, and contact the official support through the real website. Also check whether your account history shows any withdrawals you did not order.

If you pasted and ran a command, treat the computer as compromised. Stop using it for sensitive logins, and change your passwords from another, clean device. Revoke active sessions, move any funds to a new wallet created on a clean device, and run a full scan of the infected computer. Crypto withdrawals usually cannot be reversed, so speed matters.

Summary

Faucets have long been associated with small earnings and a lot of ads. Increasingly they are also associated with the risk of losing your account or your computer. A fake "I'm not a robot" check is today one of the simpler ways to do both. If something that is supposed to be a CAPTCHA asks for more than a click, it is not a CAPTCHA.

Before you click a link to an unknown site or bot, check it yourself rather than relying only on what its own screen tells you. Information about scams and user reports changes quickly, so verify the current situation in official sources.