Google is testing a reCAPTCHA check that switches on a user's camera and asks them to wave or hold up an open palm, mapping 21 coordinates of the hand to decide whether a real person is present. The experimental method, which is rolling out as a limited test, was defeated within days by testers who fed a static stock photo of a hand through the OBS Virtual Camera and passed with no live person, no video, and no AI involved.
The check sits inside Google Cloud Fraud Defense, the platform behind reCAPTCHA on login screens, sign-up forms, and checkout pages. It’s meant to catch what the older challenges increasingly miss, such as automated account creation and credential stuffing.
