Fraud Defense (reCAPTCHA)

I'm seeing a specific Android device consistently receive floor scores from reCAPTCHA Enterprise, and I can't find any signal that explains why. Looking for anyone who has seen this pattern or knows what an assessment with score: 0 and no reason codes indicates for the mobile SDK.What I observe on one device (Pixel 9 Pro, Android 17, stock, bootloader locked, verified boot green)Android SDK com.google.android.recaptcha:recaptcha:18.9.2, app installed from Google Play. Every assessment comes back like this:tokenProperties: valid: true, action matches expectedAction, clientSignalsFailed: falseriskAnalysis: score: 0, reasons: [], extendedVerdictReasons: []- 12 attempts over two days: eleven scored 0.0, one scored 0.1. Never a reason code.- Persists across two networks (Wi-Fi and mobile data), across an app-process restart with a fresh client and fresh token, and across a device reboot.- The SDK reports no error — executeTask succeeds every time, so the app has nothing to react to.- In log

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).Impact:- Users cannot read the challenge buttons or error messages, effectively blocking them from completing verification on the affected flow (a public request form).- Root-cause evidence (deterministic 7-bit corruption)  We analyzed the corrupted strings. Each displayed character equals the original code point masked to its low 7 bits — i.e. displayed = String.fromCharCode(originalCodePoint & 0x7F). This is deterministic, not random.  - Taking the low 7 bits of each code point reproduces the corrupted string exactly.  - Characters whose result falls into a control code disappear or become line breaks (e.g. 認 U+8A8D → 0x0D, 再 U+518D → 0x0D, り U+308A →0x0A, み U+307F → DEL), which accounts for the stray line breaks inside the popup.  -

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

We are using Google reCAPTCHA v3 with Thai language (hl=th). The captcha challenge occasionally displays corrupted Thai characters in the instruction area and action button. The issue occurs inside the Google-hosted reCAPTCHA dialog while the rest of the application renders Thai text correctly.Observations:Application localization is functioning correctly. Issue is occurring only within the reCAPTCHA iframe. Multiple users have reported the issue. Browser refresh does not always resolve the problem. No recent changes were made to the application code or reCAPTCHA integration.Please investigate whether there is an issue with the Thai localization resources or rendering of reCAPTCHA. 

Have noticed this appearing in the document head when inspecting the page. Just wondering what this is and why it's been added. Does anyone know? Thanks

Hi Google Cloud Community,We recently enabled reCAPTCHA v3 as a fraud-prevention mechanism and monitored the risk scores for approximately two weeks to understand its assessment behavior.During the first two days, we did not consider the scores for evaluation, as we followed the recommendation in the documentation to allow sufficient time for the risk analysis/assessment to establish.For the following five days, the results were as expected:Fraudulent transactions: The reCAPTCHA score was consistently 0.4 or below. Genuine transactions: The score was consistently 0.5 or above. This separation between fraudulent and genuine transactions was useful for defining our fraud-detection threshold.However, after approximately five days, we started seeing inconsistent results. Our genuine transactions are now also receiving very low scores, sometimes as low as 0.0, even though these transactions are legitimate.This behavior is making it difficult for us to reliably distinguish between genuine an

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often starting our app at more or less the same time)Any idea why this is happening?  What I can do to improve this? ...

My phone always says contact your IT administrator or forbidden from accessing your Google takeout or using ADB it says only administrators are allowed access. I previously had access right after I downloaded the app and lost it. How the hell do I get rid of this deep administrator a hole thats in every facet of my phone and in the system. Maybe amongst tech I will get help. I have tried literally everywhere else. Thank you... 

Hello We are seeing unexpectedly low reCAPTCHA Enterprise scores for our iOS application starting around May 20, 2026.The tokens are valid, but many legitimate users are receiving low scores ( 0.1–0.2 >= ), affecting application flows.We don’t have active support plan, and there is no option to enable support plan for our project, can anyone point to right place for resolving this issueThank you.

Loading a page with recaptcha on Safari for iOS 16 and above, (es. user agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1) the request https://www.google.com/recaptcha/api2/pat returns 401 and recaptcha initialization fails.Additional details can be found in this Github issue https://github.com/google/recaptcha/issues/561 (49 upvotes), but I ask the participants to comment here too.

Hi Fraud Defense team, Starting 2026-07-17 (zero occurrences before that date), legitimate desktopChrome 150 users on our site began receiving very low reCAPTCHA Enterprisescores (0.1-0.3) with reason code UNEXPECTED_ENVIRONMENT on our sign-inaction, blocking them from logging in. Tokens are fully valid and the actionmatches the expected action -- only the risk score collapsed. Setup: web score-based site key (v3-style), server-side assessments via thereCAPTCHA Enterprise API. Users are mostly in Taiwan on residential ISPs. Evidence that this is browser-version-specific(rejected vs. allowed-with-low-score counts, same site key and threshold,last 2 days):- Chrome 150 desktop: 306 rejected / 22 allowed- Chrome 149 desktop: 2 rejected / 23 allowed- Edge (Chromium 150): 1 rejected / 4 allowed Daily rejected count for Chrome 150: 0 (before Jul 17) -> 98 (Jul 17) ->113 (Jul 18) -> 180 (Jul 19), still rising. Chrome 150 had already beenrolled out for about two weeks before Jul 17, so

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

Hi,I'm a developer who set up reCAPTCHA keys for a client's  300 websites, and I'm trying to fully remove myself as an owner. I've hit a dead end created by the migration and need your help.Here's what happened, in order:1. I first tried to transfer/manage ownership of the keys in the classic admin console (google.com/recaptcha/admin), but the owner controls were greyed out, with this message:"Use Cloud IAM policies to manage key owners. You can remove owners until only one remains here. For more information, see Access control with IAM (https://docs.cloud.google.com/recaptcha/docs/access-control)."2. Following that instruction, I migrated the keys to the client's Google Cloud project and used Cloud IAM to transfer ownership to the client, then removed my own IAM role from the project.3. But my Google account  is still listed as the sole legacy owner of these keys in the CLASSIC console (google.com/recaptcha/admin). Per that same message, the console only lets me "remove owners until o

I am building a small phishing-reporting workflow to identify credential-harvesting pages and submit confirmed malicious URLs quickly.The goal is to reduce the lifespan of phishing pages and disrupt the attackers’ ability to profit from stolen credentials. The workflow reviews suspicious links, records the relevant indicators, and submits only URLs that appear to be genuine phishing or credential-harvesting pages.I am interested in using the Web Risk Submission API, but I have not found a self-service enrollment path. I have setup the oauth and generally have it working but the documentation mentions “Contact sales or your customer engineer to obtain access to this feature.” which has been a vortex of disappointment.Can an individual developer or small security-focused project request access? If so, what is the correct process? If not, is there another supported way to submit confirmed phishing URLs programmatically?Thank you.

On April 2, 2026, reCAPTCHA will transition  from a Data Controller to a Data Processor, offering customers greater control over their users' personal data. With this switch, customers deploying reCAPTCHA on their websites will become data controllers,  while  Google will become a data processor. To learn more,  check out our blog.  

Hello Google Cloud Security Community,As autonomous AI agents transform the internet into the Agentic Web, securing online interactions requires a fundamental shift in risk management.Join our launch webinar to see how we are evolving our 20-year heritage from reCAPTCHA into Google Cloud Fraud Defense—a comprehensive trust platform natively built on Google Cloud. As we announced at Cloud Next, this represents a transformation of our industry-leading bot protection into a comprehensive trust platform that secures the entire user journey.What we will cover: The Evolution of reCAPTCHA: Advancing to Fraud Defense to secure the complete customer journey across registration, login, and checkout. Agentic Activity Measurement: Identifying and classifying AI agent traffic using industry standards like Web Bot Auth and SPIFFE. Agentic Policy Engine: Applying granular, real-time control to allow, block, or challenge requests based on risk scores and automation types. AI-Resistant Controls:

I'm using React Native (iOS) and Firebase Phone Authentication.At one point, I enabled reCAPTCHA Enterprise from the Firebase Console via:Authentication -> Phone -> App verification -> Enable reCAPTCHA EnterpriseAfter that, phone number auth started triggering reCAPTCHA verification. Later, I disabled reCAPTCHA Enterprise in the console, but Firebase still behaves as if it's enabled. Even though appVerificationDisabledForTesting = true is set in development, production builds continue showing this error:'auth/unknown', '[auth/unknown] The reCAPTCHA SDK is not linked to your app. See https://cloud.google.com/recaptcha-enterprise/docs/instrument-ios-apps'

Hello Google, I want to know that why my results test with reCAPCHA enterprise (I use script App Automation - Browser Stack) to trigger reCAPTCHA Button in IOS App. But it always return 0.9.  Note - Code at IOS - I'm not using testing key -  It's demo project but I can't guarantee it works right now. I can't intergrate when it can't not prevent bot spam, bot abuse) - I'm using script for (App Automation - Browser Stack) to test results of reCAPTCHA and it passed all the cases. How can? It's bot, many assessments was created but always return nice scores (0.9)   If you can explain, pls. If you want email me for the iba file

How exactly does ReCaptcha v3 count the number of assessments? Does it happen after calling the /siteverify method on the server side?

I am slowly but surely working on migrating my many clients to the new reCAPTCHA area in the Cloud Console.  Sometimes I have been able to upgrade from a classic key and sometimes I had to start fresh. When working in websites, and adding the recaptcha key(s) to a specific tool (like a popup builder or opt-in form) that tool has a spot for adding those keys depending on what type i am using. V2 checkbox, V2 invisible, or V3. Meaning they have different fields depending on which type of recaptcha. So I go back into the Cloud Console to try to find what type it is. I cannot find any reference to that. The classic keys are all listed in a table with a column for type. But even when I look at the specific key (already upgraded) in a table there is no “type” column. Are ALL migrated recaptchas V3? If not, where exactly can i see what the recaptcha actually is.

It was discovered there are over 25K entries in our logs from March 21 to March 25It looks like a lot of reCAPTCHA failures with "testing@example.com" captured as the email against multiple form parameters. I do also see legitimate form submissions during this period. The failure message we are getting is mostly {"success":false,"error-codes":["invalid-input-response"]}. The thing to notice here is that after this period we did not get such spike in failures and while we are trying to submit the form the reCAPTCHA is working as expected. We are not sure how and why this issue occurred. Do we have any explanation for this? 

 Overview:We are experiencing a high volume of UNEXPECTED_ENVIRONMENT reason codes in our reCAPTCHA Enterprise assessment logs. We are looking for assistance in diagnosing the root cause of this issue, as it is happening intermittently on the same exact app builds across both iOS and Android platforms.Environment Context: Framework: React Native reCAPTCHA Integration: Using the native Google reCAPTCHA Enterprise SDKs for both iOS and Android. The Issue:For example, this week we processed roughly 10,000 reCAPTCHA requests. About 7,000 of them were successful with high scores, but approximately 3,000 of them returned a low score (below 0.5) with the UNEXPECTED_ENVIRONMENT reason code. This ratio is happening across both our iOS and Android traffic.Our Troubleshooting & Observations:What makes this confusing is that our console configuration, Site Keys, and app builds are identical for both the successful and failing requests. Identifiers match perfectly: We have verified that the i

Hi,I am integrating reCAPTCHA Enterprise with Account Verification (MFA).Flow:1. Frontend calls grecaptcha.enterprise.execute() with action LOGIN and twofactor: true2. Backend calls createAssessment with accountVerification enabled3. Response contains accountVerification with requestToken4. When I call grecaptcha.enterprise.challengeAccount() with:- account-token- containerHowever:- No popup UI is rendered- No verification code is sentCode snippet:const triggerMFA = async (requestToken: string): Promise<string> => { if (!window.grecaptcha?.enterprise) { throw new Error("reCAPTCHA not ready"); } return window.grecaptcha.enterprise.challengeAccount( import.meta.env.VITE_RECAPTCHA_SITE_KEY, { 'account-token': requestToken, // requestToken is coming from Account verification 'container': 'mfa-container', // Binded to div in log-in page } );};Sample Response:{ ..., "accountVerification": { "endpoints": [{ "emailAddress": " [removed by moderator] ", "requestToken": "tplIUFvvJUIpLaOH

Documented accessibility barriers we are seeing with reCAPTCHA v2 that cannot be remediated by website owners due to the widget’s cross‑origin iframe implementation.We understand that:WCAG allows specific CAPTCHA exceptions under SC 1.1.1 reCAPTCHA provides audio alternatives and screen reader status messaging Many automated accessibility findings are false positives at the host‑page levelThat said, manual accessibility testing (including screen reader and keyboard testing) continues to surface issues that materially impact users with disabilities and are not addressable by implementers, including:Reliance on color‑only cues to communicate status or errors Dialog / modal semantics inside the challenge that are not programmatically exposed Focus handling during challenge open/close that is inconsistent for assistive technologies Form errors and constraints within the challenge that are not programmatically associated Layout problems when users apply custom text spacing or CSS overrides

Hi, I’m been facing into issue where when trying to validate a captcha token, I get a malformed token error. I’m not sure if its possible to gather more info on why its being malformed. It works when using a test site key, but once I switch to the prod site key it consistently returns a malformed error. tokenProperties: {createTime: "1970-01-01T00:00:00Z"invalidReason: "MALFORMED"valid: false}any help is appreciated