Fraud Defense (reCAPTCHA)

Hello Google, I want to know that why my results test with reCAPCHA enterprise (I use script App Automation - Browser Stack) to trigger reCAPTCHA Button in IOS App. But it always return 0.9.  Note - Code at IOS - I'm not using testing key -  It's demo project but I can't guarantee it works right now. I can't intergrate when it can't not prevent bot spam, bot abuse) - I'm using script for (App Automation - Browser Stack) to test results of reCAPTCHA and it passed all the cases. How can? It's bot, many assessments was created but always return nice scores (0.9)   If you can explain, pls. If you want email me for the iba file

Hello Google Cloud Security Community,As autonomous AI agents transform the internet into the Agentic Web, securing online interactions requires a fundamental shift in risk management.Join our launch webinar to see how we are evolving our 20-year heritage from reCAPTCHA into Google Cloud Fraud Defense—a comprehensive trust platform natively built on Google Cloud. As we announced at Cloud Next, this represents a transformat

How exactly does ReCaptcha v3 count the number of assessments? Does it happen after calling the /siteverify method on the server side?

I am slowly but surely working on migrating my many clients to the new reCAPTCHA area in the Cloud Console.  Sometimes I have been able to upgrade from a classic key and sometimes I had to start fresh. When working in websites, and adding the recaptcha key(s) to a specific tool (like a popup builder or opt-in form) that tool has a spot for adding those keys depending on what type i am using. V2 checkbox, V2 invisible, or V3. Meaning they have different fields depending on which type of recaptcha. So I go back into the Cloud Console to try to find what type it is. I cannot find any reference to that. The classic keys are all listed in a table with a column for type. But even when I look at the specific key (already upgraded) in a table there is no “type” column. Are ALL migrated recaptchas V3? If not, where exactly can i see what the recaptcha actually is.

It was discovered there are over 25K entries in our logs from March 21 to March 25It looks like a lot of reCAPTCHA failures with "testing@example.com" captured as the email against multiple form parameters. I do also see legitimate form submissions during this period. The failure message we are getting is mostly {"success":false,"error-codes":["invalid-input-response"]}. The thing to notice here is that after this period we did not get such spike in failures and while we are trying to submit the form the reCAPTCHA is working as expected. We are not sure how and why this issue occurred. Do we have any explanation for this? 

 Overview:We are experiencing a high volume of UNEXPECTED_ENVIRONMENT reason codes in our reCAPTCHA Enterprise assessment logs. We are looking for assistance in diagnosing the root cause of this issue, as it is happening intermittently on the same exact app builds across both iOS and Android platforms.Environment Context: Framework: React Native reCAPTCHA Integration: Using the native Google reCAPTCHA Enterprise SDKs for both iOS and Android. The Issue:For example, this week we processed roughly 10,000 reCAPTCHA requests. About 7,000 of them were successful with high scores, but approximately 3,000 of them returned a low score (below 0.5) with the UNEXPECTED_ENVIRONMENT reason code. This ratio is happening across both our iOS and Android traffic.Our Troubleshooting & Observations:What make

I'm using React Native (iOS) and Firebase Phone Authentication.At one point, I enabled reCAPTCHA Enterprise from the Firebase Console via:Authentication -> Phone -> App verification -> Enable reCAPTCHA EnterpriseAfter that, phone number auth started triggering reCAPTCHA verification. Later, I disabled reCAPTCHA Enterprise in the console, but Firebase still behaves as if it's enabled. Even though appVerificationDisabledForTesting = true is set in development, production builds continue showing this error:'auth/unknown', '[auth/unknown] The reCAPTCHA SDK is not linked to your app. See https://cloud.google.com/recaptcha-enterprise/docs/instrument-ios-apps'

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

Hi,I am integrating reCAPTCHA Enterprise with Account Verification (MFA).Flow:1. Frontend calls grecaptcha.enterprise.execute() with action LOGIN and twofactor: true2. Backend calls createAssessment with accountVerification enabled3. Response contains accountVerification with requestToken4. When I call grecaptcha.enterprise.challengeAccount() with:- account-token- containerHowever:- No popup UI is rendered- No verification code is sentCode snippet:const triggerMFA = async (requestToken: string): Promise<string> => { if (!window.grecaptcha?.enterprise) { throw new Error("reCAPTCHA not ready"); } return window.grecaptcha.enterprise.challengeAccount( import.meta.env.VITE_RECAPTCHA_SITE_KEY, { 'account-token': requestToken, // requestToken is coming from Account verification 'container':

Documented accessibility barriers we are seeing with reCAPTCHA v2 that cannot be remediated by website owners due to the widget’s cross‑origin iframe implementation.We understand that:WCAG allows specific CAPTCHA exceptions under SC 1.1.1 reCAPTCHA provides audio alternatives and screen reader status messaging Many automated accessibility findings are false positives at the host‑page levelThat said, manual accessibility testing (including screen reader and keyboard testing) continues to surface issues that materially impact users with disabilities and are not addressable by implementers, including:Reliance on color‑only cues to communicate status or errors Dialog / modal semantics inside the challenge that are not programmatically exposed Focus handling during challenge open/close that i

Hi, I’m been facing into issue where when trying to validate a captcha token, I get a malformed token error. I’m not sure if its possible to gather more info on why its being malformed. It works when using a test site key, but once I switch to the prod site key it consistently returns a malformed error. tokenProperties: {createTime: "1970-01-01T00:00:00Z"invalidReason: "MALFORMED"valid: false}any help is appreciated  

So we have something along these lines “This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.” on all of our websites and forms. Are we good to remove this completely as of 2nd April, ofcourse we will be updating our privacy policy to cover the clause as well.Thanks

I want to create a reCAPTCHA v2 key, but there’s no option to select it on the creation screen in the Google Console.  Is it not possible to create a reCAPTCHA v2 key in the Google Console?

const { RecaptchaEnterpriseServiceClient } = require('@google-cloud/recaptcha-enterprise');async function createAssessment(token) {  const client = new RecaptchaEnterpriseServiceClient();  const projectPath = client.projectPath('YOUR_PROJECT_ID'); // رقم مشروعك في كلاود  const request = {    parent: projectPath,    assessment: {      event: {        token: token,        siteKey: 'YOUR_SITE_KEY', // مفتاح الموقع الخاص بنظامك      },    },  };  const [ response ] = await client.createAssessment(request);  // نظام الحشرة يقرر هنا:  if (response.riskAnalysis.score >= 0.7) {    // المستخدم حقيقي - مرر العملية    return { status: "success", access: "granted" };  } else {    // المستخدم مشبوه أو بوت - اطلق بروتوكول الحماية    return { status: "fail", reason: response.riskAnalysis.reasons };  }} 

Hello Google reCAPTCHA Support Team,We are urgently reaching out because we have exhausted every possible solution recommended by Google documentation, AI tools, and our hosting provider, and nothing has resolved our issue. We need your direct assistance.━━━━━━━━━━━━━━━━━━━━━━WHAT EXACTLY IS HAPPENING━━━━━━━━━━━━━━━━━━━━━━Every single time ANY visitor loads ANY page on our websites, a reCAPTCHA verification spinner appears on the screen. This happens:• On the very first page load• On every subsequent page load• For every single visitor from any country• On ALL pages — homepage, product pages, course pages, checkout, everywhere• On both of our websites simultaneously• Even after the visitor has already passed verification on a previous pageThe spinner appears, runs for 1-3 seconds, then disappears and the page loads. It happens on EVERY page, EVERY time, for EVERY visitor without exception. This is not a one-

Hello folks!Hope this message finds you well :) I'm working on a production application that handles around 400k daily requests, and we are currently facing an intermittent issue with reCAPTCHA validation. Occasionally, when validating tokens using the /siteverify endpoint, we receive the following response:{ "success": false, "error-codes": ["invalid-keys"]} Context We are using reCAPTCHA v2 Invisible Tokens are generated on the client and validated server-side using /siteverify The application runs under a single domain The integration has been stable and unchanged for some time What we have verified The site key and secret key are correct and consistent Bot

I’m currently running a Morse Code translator website that performs real-time conversion of plain text into Morse code and vice versa using JavaScript on the frontend. The application includes dynamic input handling, instant visual dot-dash rendering, and optional audio playback for each Morse sequence. Recently, I integrated Google reCAPTCHA (v2 and later tested v3) to protect certain endpoints from spam and abuse particularly the API routes responsible for processing translation requests.Since implementing reCAPTCHA, I’ve started encountering issues where the real-time translation feature intermittently fails or becomes unresponsive. The problem seems to occur when the reCAPTCHA token expires or isn’t properly validated before asynchronous translation requests are triggered. In some cases, users typing quickly into the input field cause multiple parallel requests, and not all of them include a valid

I'm using Flutter web, AppCheck and reCAPTCHA enterprise. I would like to reduce the cost of reCAPTCHA enterprise and hence I would like to reduce the number of assessment requests.In Firebase, I've increased "Token time to live" to 7 days so I would assume that this would somehow halve the number of assessments (assuming that my users return at least twice a week). Is this assumption correct? Unfortunately, increasing the TTL from 1 day to 7 days does not seem to have any impact on the number of assessments requests.Can someone clarify when an assessment request happens and what can be done to reduce the number of requests?

I have question does No captcha requests counted with (checkbox and image ) assessments monthly? As per google announcement  if we exceed 10,000 request then we have to pay 8$ to get extra 100,000 requests. As my website have a most of requests as No captcha, so do i have to enable billing to avoid errors or No captcha requests are excluded from assessmnets count ?  One more question does recaptcha detects automation tools or stress tests on form thus it will exceed 10,000 assessments if stress tests applied  ?  

Hi all, I’m using Firefox as my browser, but whenever I try to pass the reCAPTCHA v2 verification, I always get the image challenge (such as traffic lights or buses).Why does this happen? Is there any way to avoid getting the image challenges? Sincerely,Qimao

Hi! Previously, as per the FAQs, we were able to hide the reCAPTCHA badge on the site, so long as we referenced the branding in the user flow. Now that any references to Google’s Privacy Policy and Terms and Conditions need to be removed, do we need to display the badge at all times?   

Hi. Related to Switching Google’s role with reCAPTCHA from Data Controller to Data ProcessorI’m using Google recaptcha v2 with checkbox, so after 2 April, 2026, the badge with text Privacy - Terms will be removed from UI like this. is it right? Thank you for your supporting 

Hello Team,I’m using reCAPTCHA Enterprise on my website and, to avoid cookies, I’ve configured it to use the www.recaptcha.net source as recommended in Google's FAQ.However, I’ve noticed that some Google cookies, such as AEC and NID, are still being set under the www.recaptcha.net domain.Is there a way to completely avoid these cookies to ensure my platform remains compliant?Thank you!  

I have spent 15 hours trying over and over to get reCAPTCHA setup. Everything works until clicking on submit and every time the result says Google thinks I’m a bot. I’ve tried everything from changing the User ID to User Password in the .env file and have tied various tagging in the server.js file. Nothing has helped thus far.  This is the message I get over and over "success": false,    "error": "Invalid login: 535-5.7.8 Username and Password not accepted. For more information, go to\n535 5.7.8  https://support.google.com/mail/?p=BadCredentials a92af1059eb24-1276af2ea06sm10110769c88.7 - gsmtp",    "tip": "If this says 'BadCredentials', your .env password or email is wrong."}