Warning: The Fake “Verify You Are Human” Scam — And What To Do If You Followed It

What the scam looks like

You’re browsing a website — any website — and a page appears saying something like “Verify you are human” or “Additional verification required”. It usually carries a logo you recognise, often Cloudflare’s, and looks convincingly like the security checks real websites use.

Then it gives you instructions along these lines:

What you can’t see is that simply loading the page has already copied a hidden command onto your clipboard. If you follow the steps, you’re not proving you’re human — you’re running the attacker’s software on your own computer. Security researchers call this technique “ClickFix”, and it has spread rapidly because it bypasses antivirus software: your computer isn’t being hacked, you’re being persuaded to install it yourself.

How to spot it

• It asks you to press keyboard shortcuts — Windows+R, Windows+X, or Ctrl+V. No legitimate verification does this
• It mentions Terminal, Command Prompt, PowerShell or “Run” — an enormous red flag on any website
• It creates urgency — “additional verification required”, “your connection needs reviewing”
• Instructions on a Mac look different but work the same way — usually asking you to open Terminal and paste
• It can appear on websites you trust — legitimate sites are sometimes compromised and made to display it, so a familiar address is not a guarantee

If you think you followed the instructions

Don’t panic, but do act promptly. In order:

1. Disconnect from the internet — turn off Wi-Fi or unplug the network cable. This stops anything that was installed from communicating out
2. Run a full antivirus scan — Windows Security (built into Windows) is perfectly good. Open it, choose Virus & threat protection, then Scan options, then Full scan
3. Change your important passwords from a different device — your phone or a tablet. Start with email, then banking, then anything else important. Don’t do this from the affected computer until it’s been scanned clean
4. Turn on two-factor authentication wherever it’s offered, especially email and banking — it protects your accounts even if a password has been captured
5. Watch your bank statements for anything unexpected over the following weeks, and report anything unusual to your bank straight away

If you’re not confident doing this yourself, a local computer repair shop can run the checks for you — it’s a routine job. You can also report the scam to the National Cyber Security Centre at ncsc.gov.uk.

Staying safe online generally

• Never paste anything into a terminal or command box because a web page told you to
• Keep your computer and browser updated — most updates are security fixes
• Use two-factor authentication on email above all, since email is how passwords get reset
• Be sceptical of urgency — pressure to act immediately is the common thread in nearly every online scam
• When buying medication online, check the pharmacy is GPhC-registered and never buy prescription medicines from social media or unregulated websites

Common questions

This article is general online safety information. If you believe your bank account or card has been compromised, contact your bank immediately. Suspected fraud can be reported to Action Fraud on 0300 123 2040.