Do CAPTCHAs actually stop marketplace bots?

Why CAPTCHAs worked in the early days

In the early days of the web, telling a human from a script was easy. Distorted text in an image blocked simple scrapers because reading it required the kind of visual perception that only people had. For years, dropping a CAPTCHA on a form was the cheapest way to cut automated signups, spam posts, and brute-force logins.

Marketplaces inherited the habit. Listing forms, signup flows, and checkout pages all got puzzles, and for a while the volume of obvious automation dropped. The problem is that the attackers adapted while the defense stayed the same. A challenge designed for 2005-era scripts is now facing an industry built to defeat it.

How modern bot operations handle challenges

Professional bot operations rarely try to outsmart the puzzle with computer vision. They outsource it. CAPTCHA-solving services employ human workers who solve challenges for fractions of a cent each, with answers returned to the bot in seconds. To the marketplace, the session looks like a patient human who typed the answer correctly.

The more sophisticated operators skip solving entirely. They warm up sessions that behave like real users for days before the session ever touches a protected action: browsing listings, hovering, scrolling, adding items to watchlists. By the time the session reaches checkout, its risk score is low enough that no challenge is ever served.

Audio challenges, image grids, and behavioral checkboxes all have the same structural weakness. They test one moment in time. A bot that can afford to wait, retry, or pay a human for that one moment passes the test and keeps operating.

The shopper pays the bigger price

Every challenge is a conversion tax, and it falls almost entirely on real people. Mobile shoppers fail image challenges at far higher rates than desktop users. Older buyers, shoppers with visual impairments, and anyone on a slow connection abandon at the puzzle. One marketplace A/B test pattern shows up again and again: removing a checkout CAPTCHA lifts conversion while bot-driven fraud stays flat, because the bots were never the ones failing the puzzle.

There is also an accessibility cost that rarely makes it into the fraud team's spreadsheet. A defense that blocks legitimate users with disabilities is a liability as well as a lost sale. Regulators and platform policies are increasingly treating hostile challenge flows as a user-harm issue, not just a UX annoyance.

What to score instead of puzzles

The replacement for challenge-based defense is session-based scoring. Instead of testing one moment, the system watches the whole visit: navigation rhythm, dwell patterns, how the session moves between search, listing, and checkout. Humans browse messily. Bots browse efficiently. That difference is visible across a session even when every individual request looks legitimate.

Identity cohesion is the second signal. Real buyers reuse payment methods, shipping addresses, and devices in consistent combinations. Bot fleets rotate these elements, and the rotation itself becomes the fingerprint. No single account looks automated, but the fleet's shared infrastructure gives it away.

None of this asks anything of the shopper. The honest buyer never sees a puzzle, never waits on a spinner, never proves their humanity. The automated session gets challenged or blocked silently, based on aggregate behavior rather than one test it can buy its way past.