Fraud Defense (reCAPTCHA)

This query is regarding the recent Google reCAPTCHA migration. As per Google’s policy, the monthly free quota is 10,000 assessments, and charges apply only if this limit is exceeded. Our understanding is that if the quota is not exceeded, usage should reset at the start of each new calendar month and begin again from 1, 2, 3, etc.However, we are seeing inconsistent usage information in the Google Cloud Console:One screen shows usage based on “Last 30 days” (rolling data). Another screen (Billing → Current Month) shows no usage data and $0 cost.Due to this, it is unclear which view should be used to track monthly free-tier usage and billing.Please confirm:Whether the 10,000 free assessments are calculated per calendar month Whether usage resets every month Which console view reflects actual billable usage Thank you for your support.

Hello Google Cloud reCAPTCHA Team,We are reviewing the Google Play Data Safety declarations for our published Android application SEYCHAS.Application environment: Framework: Flutter Android minSdk: 24 Android targetSdk: 36 reCAPTCHA Android SDK: 18.7.1 Integration: Firebase Authentication (conditional reCAPTCHA verification) Our technical investigation confirmed that the primary reCAPTCHA endpoint uses HTTPS. However, we could not establish complete transport guarantees for auxiliary requests using dynamically supplied URLs and for embedded WebView navigation, redirects, and subresources.We have not identified any confirmed unencrypted transmission of user data or demonstrated security vulnerability.We would appreciate clarification of the following questions:1. Encryption in transitDoes reCAPTCHA Android SDK 18.7.1 ensure that all SDK-controlled network requests carrying user or device data use HTTPS/TLS, including auxiliary GET requests, dynamically supplied URLs, WebView nav

Our classic reCAPTCHA v3 key (domain archetravel.com, used by WordPress Contact Form 7) was auto-migrated to Google Cloud project number 474223265113. The classic admin shows "Action required: accept the invitation to the Google Cloud project".What happens: the invitation page shows "Welcome, <name>. A project owner invited you to join the project (ID: 474223265113)". Clicking Accept redirects to Resource Manager, but no access is granted. IAM for the project still reports missing resourcemanager.projects.get / getIamPolicy. Reopening the invitation shows the same pending dialog. This has been happening for months.Affected: all key owners. Tested today (22 Oct 2026) with two Google Workspace users of archetravel.com (org ID 1095431403131), one of them the super admin. Same result with both the banner link and /invitation?project=474223265113&account=...&memberEmail=...Already ruled out:- Correct account (verified in the dialog greeting and the account menu)- No pending Cl

I am unable to add or remove domains from the allowed domain list when editing a key. I click save and get a success toast message, but the changes aren’t actually committed.I noticed it yesterday (10/13) at 2pm ET. I can’t open a support ticket b/c we’re running the api.js not enterprise.js

Once a key is created, I'm not finding how to add a domain to an existing enterprise key.I tried asking Gemini and providing it screenshots and it is stuck too, so I'm thinking this feature doesn't exist yet. If it does, please let me know where that is administered.

I am unable to add or remove allowed domains when editing a key. When I try to add or remove a domain, and click save, I get a success message. But, when I edit the key again the changes haven’t been committed. This has been happening since 10/13/26. I noticed the issue at approximately 2PM ET 10/13/26.

I received the following email about my recaptcha quota :Summary: You are receiving this email because your site key exceeded the free assessments limit in reCAPTCHA V2 or V3. Please use our new migration path to upgrade to reCAPTCHA Enterprise so you can have unlimited assessments for your site key.Thank you for being a reCAPTCHA user. Your site key is currently using reCAPTCHA over the quota limit of 1 million calls per month. If you do not migrate to reCAPTCHA Enterprise, within 30 days following this notice, your site key will not protect your webpage after 1 million calls per month.If a site key exceeds 1000 calls per second, then some requests may not be processed. If a V3 site key exceeds 1 million calls per month, then the site might return a static score of 0.9 and an error message that says `"over free quota."` for the remainder of the month. If a V2 site key exceeds its monthly quota, then the following or a similar message may be displayed to your customers in the reCAPTCHA

Hello,I'm getting intermittent 500 INTERNAL errors from accounts/mfaEnrollment:start and accounts/mfaSignIn:start after enabling Fraud Defense "Enforce" mode (phoneEnforcementState) for SMS-based MFA in my Identity Platform project.The exact same requests work fine when I switch phoneEnforcementState to "AUDIT". I tested tollFraudManagedRules.startScore as low as 0.1, but even at this threshold some legitimate requests still fail with the error:{  "error": {    "code": 500,    "message": "Internal error encountered.",    "status": "INTERNAL"  }} Has anyone successfully debugged this kind of toll fraud protection issue? 

Hello All ,Issue - reCAPTCHA Enterprise Policy-Based Challenge consistently returns BROWSER_ERROR for some usersWe are using reCAPTCHA Enterprise Policy-Based Challenge on an ASP.NET Web Forms application.Site key integration type: Policy-Based ChallengeAction: confirmThreshold: 0.3For some production users, grecaptcha.enterprise.execute() returns a token successfully, but when we create the server-side assessment at backend code , Google returns:TokenProperties.Valid = falseInvalidReason = BROWSER_ERROROther fields are:Score = 0Challenge = UNSPECIFIEDOne affected user received the same result repeatedly over several hours rather than just once.Questions:What exactly causes BROWSER_ERROR for Policy-Based Challenge? We did see that its not only for Policy-Based but also for a Score based also we do get some times. If execute() returns a token but the subsequent assessment returns BROWSER_ERROR, what browser/network communication is failing? Is there a recommended list of Google endpoint

Our embedded form is receiving hundreds of bot signups. When I tried to enable reCAPTCHA, it displays ‘This site is exceeding reCAPTCHA Enterprise free quota.’ Can you confirm whether this is an issue with MailerLite’s reCAPTCHA configuration? Or….?

We host a number of servers for customers, sharing a public IP range. We have been having intermittent problems with customers receiving ReCAPTCHA challenges in a loop. They are presented with an endless stream of images and therefore can't reach the website they need. This problem is particularly frequent when using a particular piece of software which uses the CefSharp framework as an integrated web browser. We believe that our IP range has a poor reputation with ReCAPTCHA, perhaps due to the high volume of users sharing the IP range. Is there anything we can do about this?

I'm seeing a specific Android device consistently receive floor scores from reCAPTCHA Enterprise, and I can't find any signal that explains why. Looking for anyone who has seen this pattern or knows what an assessment with score: 0 and no reason codes indicates for the mobile SDK.What I observe on one device (Pixel 9 Pro, Android 17, stock, bootloader locked, verified boot green)Android SDK com.google.android.recaptcha:recaptcha:18.9.2, app installed from Google Play. Every assessment comes back like this:tokenProperties: valid: true, action matches expectedAction, clientSignalsFailed: falseriskAnalysis: score: 0, reasons: [], extendedVerdictReasons: []- 12 attempts over two days: eleven scored 0.0, one scored 0.1. Never a reason code.- Persists across two networks (Wi-Fi and mobile data), across an app-process restart with a fresh client and fresh token, and across a device reboot.- The SDK reports no error — executeTask succeeds every time, so the app has nothing to react to.- In log

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).Impact:- Users cannot read the challenge buttons or error messages, effectively blocking them from completing verification on the affected flow (a public request form).- Root-cause evidence (deterministic 7-bit corruption)  We analyzed the corrupted strings. Each displayed character equals the original code point masked to its low 7 bits — i.e. displayed = String.fromCharCode(originalCodePoint & 0x7F). This is deterministic, not random.  - Taking the low 7 bits of each code point reproduces the corrupted string exactly.  - Characters whose result falls into a control code disappear or become line breaks (e.g. 認 U+8A8D → 0x0D, 再 U+518D → 0x0D, り U+308A →0x0A, み U+307F → DEL), which accounts for the stray line breaks inside the popup.  -

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

We are using Google reCAPTCHA v3 with Thai language (hl=th). The captcha challenge occasionally displays corrupted Thai characters in the instruction area and action button. The issue occurs inside the Google-hosted reCAPTCHA dialog while the rest of the application renders Thai text correctly.Observations:Application localization is functioning correctly. Issue is occurring only within the reCAPTCHA iframe. Multiple users have reported the issue. Browser refresh does not always resolve the problem. No recent changes were made to the application code or reCAPTCHA integration.Please investigate whether there is an issue with the Thai localization resources or rendering of reCAPTCHA. 

Have noticed this appearing in the document head when inspecting the page. Just wondering what this is and why it's been added. Does anyone know? Thanks

Hi Google Cloud Community,We recently enabled reCAPTCHA v3 as a fraud-prevention mechanism and monitored the risk scores for approximately two weeks to understand its assessment behavior.During the first two days, we did not consider the scores for evaluation, as we followed the recommendation in the documentation to allow sufficient time for the risk analysis/assessment to establish.For the following five days, the results were as expected:Fraudulent transactions: The reCAPTCHA score was consistently 0.4 or below. Genuine transactions: The score was consistently 0.5 or above. This separation between fraudulent and genuine transactions was useful for defining our fraud-detection threshold.However, after approximately five days, we started seeing inconsistent results. Our genuine transactions are now also receiving very low scores, sometimes as low as 0.0, even though these transactions are legitimate.This behavior is making it difficult for us to reliably distinguish between genuine an

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often starting our app at more or less the same time)Any idea why this is happening?  What I can do to improve this? ...

My phone always says contact your IT administrator or forbidden from accessing your Google takeout or using ADB it says only administrators are allowed access. I previously had access right after I downloaded the app and lost it. How the hell do I get rid of this deep administrator a hole thats in every facet of my phone and in the system. Maybe amongst tech I will get help. I have tried literally everywhere else. Thank you... 

Hello We are seeing unexpectedly low reCAPTCHA Enterprise scores for our iOS application starting around May 20, 2026.The tokens are valid, but many legitimate users are receiving low scores ( 0.1–0.2 >= ), affecting application flows.We don’t have active support plan, and there is no option to enable support plan for our project, can anyone point to right place for resolving this issueThank you.

Loading a page with recaptcha on Safari for iOS 16 and above, (es. user agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1) the request https://www.google.com/recaptcha/api2/pat returns 401 and recaptcha initialization fails.Additional details can be found in this Github issue https://github.com/google/recaptcha/issues/561 (49 upvotes), but I ask the participants to comment here too.

Hi Fraud Defense team, Starting 2026-07-17 (zero occurrences before that date), legitimate desktopChrome 150 users on our site began receiving very low reCAPTCHA Enterprisescores (0.1-0.3) with reason code UNEXPECTED_ENVIRONMENT on our sign-inaction, blocking them from logging in. Tokens are fully valid and the actionmatches the expected action -- only the risk score collapsed. Setup: web score-based site key (v3-style), server-side assessments via thereCAPTCHA Enterprise API. Users are mostly in Taiwan on residential ISPs. Evidence that this is browser-version-specific(rejected vs. allowed-with-low-score counts, same site key and threshold,last 2 days):- Chrome 150 desktop: 306 rejected / 22 allowed- Chrome 149 desktop: 2 rejected / 23 allowed- Edge (Chromium 150): 1 rejected / 4 allowed Daily rejected count for Chrome 150: 0 (before Jul 17) -> 98 (Jul 17) ->113 (Jul 18) -> 180 (Jul 19), still rising. Chrome 150 had already beenrolled out for about two weeks before Jul 17, so

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

Hi,I'm a developer who set up reCAPTCHA keys for a client's  300 websites, and I'm trying to fully remove myself as an owner. I've hit a dead end created by the migration and need your help.Here's what happened, in order:1. I first tried to transfer/manage ownership of the keys in the classic admin console (google.com/recaptcha/admin), but the owner controls were greyed out, with this message:"Use Cloud IAM policies to manage key owners. You can remove owners until only one remains here. For more information, see Access control with IAM (https://docs.cloud.google.com/recaptcha/docs/access-control)."2. Following that instruction, I migrated the keys to the client's Google Cloud project and used Cloud IAM to transfer ownership to the client, then removed my own IAM role from the project.3. But my Google account  is still listed as the sole legacy owner of these keys in the CLASSIC console (google.com/recaptcha/admin). Per that same message, the console only lets me "remove owners until o

I am building a small phishing-reporting workflow to identify credential-harvesting pages and submit confirmed malicious URLs quickly.The goal is to reduce the lifespan of phishing pages and disrupt the attackers’ ability to profit from stolen credentials. The workflow reviews suspicious links, records the relevant indicators, and submits only URLs that appear to be genuine phishing or credential-harvesting pages.I am interested in using the Web Risk Submission API, but I have not found a self-service enrollment path. I have setup the oauth and generally have it working but the documentation mentions “Contact sales or your customer engineer to obtain access to this feature.” which has been a vortex of disappointment.Can an individual developer or small security-focused project request access? If so, what is the correct process? If not, is there another supported way to submit confirmed phishing URLs programmatically?Thank you.