CAPTCHA Farm

When an automated client encounters a CAPTCHA it cannot solve, it forwards the challenge to a solving service through an API. The service returns the answer, which the bot submits as if it had solved the challenge itself. This decoupling means the bot never needs to understand the puzzle; it only needs to relay it and pay for the response.

Human-powered farms route challenges to workers who solve them manually for a fraction of a cent each, often in high-volume operations. Automated farms instead use machine-learning models and specialized solvers that have grown increasingly capable, particularly for image and text puzzles. Many services blend both approaches, escalating to humans only when automation fails.

Because solving is priced per challenge, the economics favor the attacker whenever the value extracted per successful request exceeds the small solving fee. This is why CAPTCHAs alone rarely stop determined, well-funded abuse: they impose a cost, but a bounded and often affordable one, rather than a hard technical barrier.

The existence of CAPTCHA farms is the central argument for detection that does not depend on a solvable challenge. If the underlying automation can be identified from its environment, behavior, and network context, then outsourcing the puzzle answer does not help the attacker, because the session was already recognized as automated before the challenge was ever presented.