How does Google reCAPTCHA v2 work behind the scenes?

This is speculation, but based on Google’s reference to the “risk analysis engine” they use (http://googleonlinesecurity.blogspot.com/2014/12/are-you-robot-introducing-no-captcha.html)

I would assume it looks at how you behaved prior to clicking, how your cursor moved on its way to the check (organic path/acceleration), which part of the checkbox was clicked (random places, or dead on center every time), browser fingerprint, Google cookies & contents, click location history tied to your fingerprint or account if it detects one etc.

It’s fairly difficult to fake “organic” behavior in such a way that it would fool a continuously learning pattern detection engine. In the cases where it’s not sure, it still prompts you to match an actual CAPTCHA string.

Leave a Comment