Definition
A CAPTCHA is a challenge-response test used to tell human users apart from automated scripts — distorted text, image-selection puzzles, or increasingly invisible checks that score a session's behaviour and device signals without asking the user to do anything unless the score looks risky. Sites place it at points that attract automation: account registration, login, password reset, deposit, promo-code redemption, and forms.
The aim is to raise the cost of bulk automated abuse — mass fake-account creation, credential stuffing, bonus farming, scraping — to the point where it is no longer worthwhile, while adding as little friction as possible for real users. Modern implementations lean on risk scoring so that most genuine users pass silently and only suspicious sessions get an explicit challenge.
In context
For iGaming operators, CAPTCHA is one layer of anti-fraud and anti-abuse control, protecting registration against mass fake accounts (used for bonus farming and multi-accounting), login against credential stuffing, and promotional endpoints against automated claiming. It works alongside device fingerprinting, velocity checks, email and phone validation, and KYC, and it is deliberately positioned so that abuse automation hits friction while a normal player barely notices.
There are limits and trade-offs affiliates should understand for conversion and complaints context. CAPTCHA adds friction exactly at the registration and deposit steps that affiliate traffic must pass, and an over-aggressive configuration can suppress genuine conversions, particularly on mobile or for users on shared or VPN IP ranges that score as risky.
A spike in CAPTCHA challenges for one traffic source can also be a quality signal — bot or low-quality traffic triggering the risk scoring. Anti-bot vendors also state that their tools should not be used to block accessibility or to gate content abusively.
One firm line for affiliates: content must never explain or promote ways to solve or bypass CAPTCHAs at scale, since CAPTCHA-solving services exist specifically to enable the bulk fake-account and bonus-abuse activity that operators and honest affiliates both lose from.
Worked example
An operator adds risk-scored CAPTCHA to registration and promo redemption. Bulk fake-account attempts for a no-deposit bonus drop sharply.
The operator monitors challenge rates by traffic source; one affiliate's registrations show a 70% challenge rate, flagging low-quality or automated traffic, which is investigated separately from the CAPTCHA change.
Related terms
Frequently asked questions
Browse the full iGaming & affiliate glossary — hundreds of EN/RU terms with examples.
← Back to glossary