Cyber criminals break CAPTCHAs for account takeover (ATO) purposes. ATO is a method of credential theft where the malicious agent takes over the account/profile of the victim leading to unauthorized activities.

Credential stuffing is one way to carry over an ATO; here, passwords collected from different places or previous attacks are used to break into many sites. This form of ATO may or may not require CAPTCHA. Here, fraudsters use the propensity that the victim may reuse a password.

For the preceding case, if there are CAPTCHAs that need to be cracked, then one of the following methods are adopted:

• Use of human labor to crack the CAPTCHA: Malicious agents often use cheap human labor to decode CAPTCHA. Human agents are made to solve CAPTCHAs and get paid either on an hourly rate or by the number of CAPTCHAs they solve. The workforce is tactically selected from the under-developed countries, and together they are able to solve hundreds of CAPTCHAs per hour. A study from the University of California at San Diego suggested that it takes approximately $1,000 to solve one million CAPTCHAs. Often, malicious owners repost CAPTCHAs to sites that get lots of human traffic and get them solved there. 

Malicious agents often make use of the insecure implementation used by website owners. In many cases, the session ID of a solved CAPTCHA can be used to bypass existing unsolved CAPTCHAs.

• Use of brute force to crack CAPTCHA: These are attacks where machines try all combinations of alpha-numeric characters until they are able to crack CAPTCHA.