Fraud Defense (reCAPTCHA)

Hi,I'm a developer who set up reCAPTCHA keys for a client's  300 websites, and I'm trying to fully remove myself as an owner. I've hit a dead end created by the migration and need your help.Here's what happened, in order:1. I first tried to transfer/manage ownership of the keys in the classic admin console (google.com/recaptcha/admin), but the owner controls were greyed out, with this message:"Use Cloud IAM policies to manage key owners. You can remove owners until only one remains here. For more information, see Access control with IAM (https://docs.cloud.google.com/recaptcha/docs/access-control)."2. Following that instruction, I migrated the keys to the client's Google Cloud project and used Cloud IAM to transfer ownership to the client, then removed my own IAM role from the project.3. But my Google account  is still listed as the sole legacy owner of these keys in the CLASSIC console (google.com/recaptcha/admin). Per that same message, the console only lets me "remove owners until o

Hi Fraud Defense team, Starting 2026-07-17 (zero occurrences before that date), legitimate desktopChrome 150 users on our site began receiving very low reCAPTCHA Enterprisescores (0.1-0.3) with reason code UNEXPECTED_ENVIRONMENT on our sign-inaction, blocking them from logging in. Tokens are fully valid and the actionmatches the expected action -- only the risk score collapsed. Setup: web score-based site key (v3-style), server-side assessments via thereCAPTCHA Enterprise API. Users are mostly in Taiwan on residential ISPs. Evidence that this is browser-version-specific(rejected vs. allowed-with-low-score counts, same site key and threshold,last 2 days):- Chrome 150 desktop: 306 rejected / 22 allowed- Chrome 149 desktop: 2 rejected / 23 allowed- Edge (Chromium 150): 1 rejected / 4 allowed Daily rejected count for Chrome 150: 0 (before Jul 17) -> 98 (Jul 17) ->113 (Jul 18) -> 180 (Jul 19), still rising. Chrome 150 had already beenrolled out for about two weeks before Jul 17, so

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often starting our app at more or less the same time)Any idea why this is happening?  What I can do to improve this? ...

I am building a small phishing-reporting workflow to identify credential-harvesting pages and submit confirmed malicious URLs quickly.The goal is to reduce the lifespan of phishing pages and disrupt the attackers’ ability to profit from stolen credentials. The workflow reviews suspicious links, records the relevant indicators, and submits only URLs that appear to be genuine phishing or credential-harvesting pages.I am interested in using the Web Risk Submission API, but I have not found a self-service enrollment path. I have setup the oauth and generally have it working but the documentation mentions “Contact sales or your customer engineer to obtain access to this feature.” which has been a vortex of disappointment.Can an individual developer or small security-focused project request access? If so, what is the correct process? If not, is there another supported way to submit confirmed phishing URLs programmatically?Thank you.

Hello Google Cloud Security Community,As autonomous AI agents transform the internet into the Agentic Web, securing online interactions requires a fundamental shift in risk management.Join our launch webinar to see how we are evolving our 20-year heritage from reCAPTCHA into Google Cloud Fraud Defense—a comprehensive trust platform natively built on Google Cloud. As we announced at Cloud Next, this represents a transformation of our industry-leading bot protection into a comprehensive trust platform that secures the entire user journey.What we will cover: The Evolution of reCAPTCHA: Advancing to Fraud Defense to secure the complete customer journey across registration, login, and checkout. Agentic Activity Measurement: Identifying and classifying AI agent traffic using industry standards like Web Bot Auth and SPIFFE. Agentic Policy Engine: Applying granular, real-time control to allow, block, or challenge requests based on risk scores and automation types. AI-Resistant Controls:

Hello We are seeing unexpectedly low reCAPTCHA Enterprise scores for our iOS application starting around May 20, 2026.The tokens are valid, but many legitimate users are receiving low scores ( 0.1–0.2 >= ), affecting application flows.We don’t have active support plan, and there is no option to enable support plan for our project, can anyone point to right place for resolving this issueThank you.

I'm using React Native (iOS) and Firebase Phone Authentication.At one point, I enabled reCAPTCHA Enterprise from the Firebase Console via:Authentication -> Phone -> App verification -> Enable reCAPTCHA EnterpriseAfter that, phone number auth started triggering reCAPTCHA verification. Later, I disabled reCAPTCHA Enterprise in the console, but Firebase still behaves as if it's enabled. Even though appVerificationDisabledForTesting = true is set in development, production builds continue showing this error:'auth/unknown', '[auth/unknown] The reCAPTCHA SDK is not linked to your app. See https://cloud.google.com/recaptcha-enterprise/docs/instrument-ios-apps'

Hello Google, I want to know that why my results test with reCAPCHA enterprise (I use script App Automation - Browser Stack) to trigger reCAPTCHA Button in IOS App. But it always return 0.9.  Note - Code at IOS - I'm not using testing key -  It's demo project but I can't guarantee it works right now. I can't intergrate when it can't not prevent bot spam, bot abuse) - I'm using script for (App Automation - Browser Stack) to test results of reCAPTCHA and it passed all the cases. How can? It's bot, many assessments was created but always return nice scores (0.9)   If you can explain, pls. If you want email me for the iba file

How exactly does ReCaptcha v3 count the number of assessments? Does it happen after calling the /siteverify method on the server side?

I am slowly but surely working on migrating my many clients to the new reCAPTCHA area in the Cloud Console.  Sometimes I have been able to upgrade from a classic key and sometimes I had to start fresh. When working in websites, and adding the recaptcha key(s) to a specific tool (like a popup builder or opt-in form) that tool has a spot for adding those keys depending on what type i am using. V2 checkbox, V2 invisible, or V3. Meaning they have different fields depending on which type of recaptcha. So I go back into the Cloud Console to try to find what type it is. I cannot find any reference to that. The classic keys are all listed in a table with a column for type. But even when I look at the specific key (already upgraded) in a table there is no “type” column. Are ALL migrated recaptchas V3? If not, where exactly can i see what the recaptcha actually is.

It was discovered there are over 25K entries in our logs from March 21 to March 25It looks like a lot of reCAPTCHA failures with "testing@example.com" captured as the email against multiple form parameters. I do also see legitimate form submissions during this period. The failure message we are getting is mostly {"success":false,"error-codes":["invalid-input-response"]}. The thing to notice here is that after this period we did not get such spike in failures and while we are trying to submit the form the reCAPTCHA is working as expected. We are not sure how and why this issue occurred. Do we have any explanation for this? 

 Overview:We are experiencing a high volume of UNEXPECTED_ENVIRONMENT reason codes in our reCAPTCHA Enterprise assessment logs. We are looking for assistance in diagnosing the root cause of this issue, as it is happening intermittently on the same exact app builds across both iOS and Android platforms.Environment Context: Framework: React Native reCAPTCHA Integration: Using the native Google reCAPTCHA Enterprise SDKs for both iOS and Android. The Issue:For example, this week we processed roughly 10,000 reCAPTCHA requests. About 7,000 of them were successful with high scores, but approximately 3,000 of them returned a low score (below 0.5) with the UNEXPECTED_ENVIRONMENT reason code. This ratio is happening across both our iOS and Android traffic.Our Troubleshooting & Observations:What makes this confusing is that our console configuration, Site Keys, and app builds are identical for both the successful and failing requests. Identifiers match perfectly: We have verified that the i

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

Hi,I am integrating reCAPTCHA Enterprise with Account Verification (MFA).Flow:1. Frontend calls grecaptcha.enterprise.execute() with action LOGIN and twofactor: true2. Backend calls createAssessment with accountVerification enabled3. Response contains accountVerification with requestToken4. When I call grecaptcha.enterprise.challengeAccount() with:- account-token- containerHowever:- No popup UI is rendered- No verification code is sentCode snippet:const triggerMFA = async (requestToken: string): Promise<string> => { if (!window.grecaptcha?.enterprise) { throw new Error("reCAPTCHA not ready"); } return window.grecaptcha.enterprise.challengeAccount( import.meta.env.VITE_RECAPTCHA_SITE_KEY, { 'account-token': requestToken, // requestToken is coming from Account verification 'container': 'mfa-container', // Binded to div in log-in page } );};Sample Response:{ ..., "accountVerification": { "endpoints": [{ "emailAddress": " [removed by moderator] ", "requestToken": "tplIUFvvJUIpLaOH

Documented accessibility barriers we are seeing with reCAPTCHA v2 that cannot be remediated by website owners due to the widget’s cross‑origin iframe implementation.We understand that:WCAG allows specific CAPTCHA exceptions under SC 1.1.1 reCAPTCHA provides audio alternatives and screen reader status messaging Many automated accessibility findings are false positives at the host‑page levelThat said, manual accessibility testing (including screen reader and keyboard testing) continues to surface issues that materially impact users with disabilities and are not addressable by implementers, including:Reliance on color‑only cues to communicate status or errors Dialog / modal semantics inside the challenge that are not programmatically exposed Focus handling during challenge open/close that is inconsistent for assistive technologies Form errors and constraints within the challenge that are not programmatically associated Layout problems when users apply custom text spacing or CSS overrides

Hi, I’m been facing into issue where when trying to validate a captcha token, I get a malformed token error. I’m not sure if its possible to gather more info on why its being malformed. It works when using a test site key, but once I switch to the prod site key it consistently returns a malformed error. tokenProperties: {createTime: "1970-01-01T00:00:00Z"invalidReason: "MALFORMED"valid: false}any help is appreciated  

So we have something along these lines “This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.” on all of our websites and forms. Are we good to remove this completely as of 2nd April, ofcourse we will be updating our privacy policy to cover the clause as well.Thanks

I want to create a reCAPTCHA v2 key, but there’s no option to select it on the creation screen in the Google Console.  Is it not possible to create a reCAPTCHA v2 key in the Google Console?

const { RecaptchaEnterpriseServiceClient } = require('@google-cloud/recaptcha-enterprise');async function createAssessment(token) {  const client = new RecaptchaEnterpriseServiceClient();  const projectPath = client.projectPath('YOUR_PROJECT_ID'); // رقم مشروعك في كلاود  const request = {    parent: projectPath,    assessment: {      event: {        token: token,        siteKey: 'YOUR_SITE_KEY', // مفتاح الموقع الخاص بنظامك      },    },  };  const [ response ] = await client.createAssessment(request);  // نظام الحشرة يقرر هنا:  if (response.riskAnalysis.score >= 0.7) {    // المستخدم حقيقي - مرر العملية    return { status: "success", access: "granted" };  } else {    // المستخدم مشبوه أو بوت - اطلق بروتوكول الحماية    return { status: "fail", reason: response.riskAnalysis.reasons };  }} 

Hello Google reCAPTCHA Support Team,We are urgently reaching out because we have exhausted every possible solution recommended by Google documentation, AI tools, and our hosting provider, and nothing has resolved our issue. We need your direct assistance.━━━━━━━━━━━━━━━━━━━━━━WHAT EXACTLY IS HAPPENING━━━━━━━━━━━━━━━━━━━━━━Every single time ANY visitor loads ANY page on our websites, a reCAPTCHA verification spinner appears on the screen. This happens:• On the very first page load• On every subsequent page load• For every single visitor from any country• On ALL pages — homepage, product pages, course pages, checkout, everywhere• On both of our websites simultaneously• Even after the visitor has already passed verification on a previous pageThe spinner appears, runs for 1-3 seconds, then disappears and the page loads. It happens on EVERY page, EVERY time, for EVERY visitor without exception. This is not a one-time check — it repeats on every single page navigation.WHEN IT STARTED━━━━━━━━

Hello folks!Hope this message finds you well :) I'm working on a production application that handles around 400k daily requests, and we are currently facing an intermittent issue with reCAPTCHA validation. Occasionally, when validating tokens using the /siteverify endpoint, we receive the following response:{ "success": false, "error-codes": ["invalid-keys"]} Context We are using reCAPTCHA v2 Invisible Tokens are generated on the client and validated server-side using /siteverify The application runs under a single domain The integration has been stable and unchanged for some time What we have verified The site key and secret key are correct and consistent Both keys belong to the same reCAPTCHA configuration We are not rotating keys or switching environments dynamically The same keys are used for all requests The error is intermittent — the majority of validations succeed Additional observations The error only appears in the backend response from /siteverify We co

I’m currently running a Morse Code translator website that performs real-time conversion of plain text into Morse code and vice versa using JavaScript on the frontend. The application includes dynamic input handling, instant visual dot-dash rendering, and optional audio playback for each Morse sequence. Recently, I integrated Google reCAPTCHA (v2 and later tested v3) to protect certain endpoints from spam and abuse particularly the API routes responsible for processing translation requests.Since implementing reCAPTCHA, I’ve started encountering issues where the real-time translation feature intermittently fails or becomes unresponsive. The problem seems to occur when the reCAPTCHA token expires or isn’t properly validated before asynchronous translation requests are triggered. In some cases, users typing quickly into the input field cause multiple parallel requests, and not all of them include a valid or refreshed token, leading to failed verification responses from the backend.Additio

I'm using Flutter web, AppCheck and reCAPTCHA enterprise. I would like to reduce the cost of reCAPTCHA enterprise and hence I would like to reduce the number of assessment requests.In Firebase, I've increased "Token time to live" to 7 days so I would assume that this would somehow halve the number of assessments (assuming that my users return at least twice a week). Is this assumption correct? Unfortunately, increasing the TTL from 1 day to 7 days does not seem to have any impact on the number of assessments requests.Can someone clarify when an assessment request happens and what can be done to reduce the number of requests?

I have question does No captcha requests counted with (checkbox and image ) assessments monthly? As per google announcement  if we exceed 10,000 request then we have to pay 8$ to get extra 100,000 requests. As my website have a most of requests as No captcha, so do i have to enable billing to avoid errors or No captcha requests are excluded from assessmnets count ?  One more question does recaptcha detects automation tools or stress tests on form thus it will exceed 10,000 assessments if stress tests applied  ?