You clicked every square with a traffic light in it. You are certain. It says try again. Second round: bicycles this time, and half of one wheel pokes into a corner square, and you have four seconds to decide whether that counts.
If this happens to you constantly, here is the first thing worth knowing: it is very often not you. Those puzzles are tuned to catch automated traffic, and a lot of ordinary human circumstances — a slow phone, a shared office connection, low vision, shaky hands, a VPN, being tired — look statistically similar to a bot from the other side of the screen. Below is what is actually going on, what you can do in the next two minutes, and what the sites you use should be doing differently.
What the puzzle is really testing
It is not testing whether you can see a bicycle. It is scoring how you behave: how your mouse moved on the way to the button, how quickly you clicked, whether your browser looks like thousands of others, what reputation your IP address carries. The picture grid is mostly a stalling device while that scoring happens in the background.
That is why the difficulty seems to vary for no reason. Two people, same website, same minute: one gets a checkbox that clears instantly, the other gets four rounds of buses. The puzzle got harder because something about the second person's setup scored lower — not because they are worse at spotting buses.
Why they fail real people
The circumstances that make you look "suspicious" are extremely common:
- Low vision or colour vision differences. Distorted text and dim, low-contrast photo grids are hard by design. That design does not distinguish between a bot and someone using 200% zoom.
- Screen readers. A picture grid has nothing useful to read aloud. The audio alternative exists, but it is frequently a garbled recording over deliberate background noise.
- Dyslexia. Warped, overlapping letters are exactly the input that is hardest to decode, and the timer makes it worse.
- Tremor, arthritis, or a touchscreen on a bumpy bus. Drag-the-slider and rotate-the-image puzzles require fine motor control on a deadline.
- Cognitive load or fatigue. "Select all images with a crosswalk" is a vocabulary question as much as a visual one, and it assumes a particular country's street furniture.
- Language. Text puzzles in a language you don't read fluently are a wall, not a speed bump.
- Older phones and slow connections. If the widget's scripts load slowly or partially, verification can fail before you touch anything.
- VPNs, shared office Wi-Fi, and mobile data. All put you behind an address that thousands of other people also use. Your score drops because of your neighbours.
None of that is a personal failing. It is a system optimising for one thing and quietly costing another.
Seven things to try right now
- Use the audio option. Look for a headphone icon in the widget. It is usually easier than a fourth round of bicycles, and on a screen reader it is the intended path.
- Turn the VPN off for that one page. If you trust the network you are on, disconnecting often drops you into an easier score band immediately. Turn it back on afterwards.
- Let the page's scripts run. Aggressive ad blockers and strict privacy modes frequently break verification widgets. Allow scripts for that single site, reload, and try again.
- Update your browser. An out-of-date browser fails widgets in ways that produce no error message — just endless retries.
- Reload before you retry. Verification tokens expire. If the page has been sitting open, a fresh load is often the whole fix.
- Slow down slightly. Filling a form faster than a human plausibly could is itself a low score. It is a strange piece of advice, and it works.
- Sign in with a passkey if the site offers one. Passkeys usually skip the verification step entirely, because your device has already proved who you are — see how passkeys and passwordless login work for the setup.
If none of that works, contact the site. Many organisations are legally obliged to provide an accessible alternative, and a support agent can usually complete the action for you or send a one-time link that bypasses the form.
What sites should be doing instead
If you run or build a site, the accessibility guidelines are unambiguous: any test based on sensory perception needs an alternative in another modality, plus a route for people who can't use either. In practice, the better options are:
- Invisible, risk-based checks. Score the request in the background and only interrupt when something genuinely looks wrong. Most visitors then see nothing at all.
- Rate limiting and honeypots. A hidden field that only an automated script would fill catches a surprising amount of junk at zero cost to real people.
- Passkeys and email magic links. These move verification onto the device, where it is both stronger and invisible. The broader landscape of identity-verification systems covers where each approach fits.
- A human escape hatch. A clearly-labelled "I can't complete this" link that reaches a person. Every accessible verification flow needs one.
The pattern to avoid is stacking: a puzzle and an SMS code and an email confirmation. Each one adds a group of people who cannot get through, and the security gain past the first layer is much smaller than it feels.
How assistive and automation tools handle it behind the scenes
There is a category of software that has to complete these steps on someone's behalf — accessibility tools that drive a browser for a user who can't operate one directly, testing tools that check a company's own site, monitoring systems that verify their own checkout still works.
Those tools generally call a verification-solving service rather than trying to render the puzzle to a person who cannot solve it. CaptchaAI is one such service, and it lists accessibility tools and QA automation among the audiences it is built for. The mechanism is straightforward: the tool sends the challenge details to an API, the service returns a verification token a few seconds later, and the tool submits the form. CaptchaAI publishes solve-time ceilings by challenge type — under half a second for image puzzles, under four seconds for the invisible scored version, under sixty seconds for the picture-grid version — along with a stated success rate above 99%.
Worth being clear about what that is and isn't. It is a bridge for people and systems with a legitimate right to complete an action they cannot complete manually — your own account, your own site, your own tooling. It is not a way around a website's security, and using it that way would be both a terms-of-service problem and, in plenty of jurisdictions, a legal one.
What's replacing all this
The direction of travel is away from puzzles entirely. Passkeys tie the login to a device you already unlock with your face or fingerprint. Device attestation lets a browser vouch that a real device is present without a puzzle or a tracker. Risk scoring is getting good enough that most sessions never need an interruption. The picture grids are not gone yet, but they are increasingly the fallback rather than the front door.
FAQ
Why do I get harder CAPTCHAs than everyone else? Usually your network. Shared Wi-Fi, mobile data, VPNs, and older devices all lower the background score, and a lower score means more rounds. It is a reputation system you never opted into, and it is not a judgement about you.
Is the audio CAPTCHA easier? Often, especially with headphones and a quiet room. Quality varies a lot between sites. If the audio is unusable too, that is exactly the situation the site's accessibility contact route exists for.
Do CAPTCHA-solving browser extensions actually work? Some do, but check what you are installing very carefully — an extension with permission to read every page you visit is a serious privacy trade, and this category attracts bad actors. Never grant one access to banking or email.
Is it legal to use a solving service? It depends entirely on what you point it at. For your own site, your own testing, or an accessibility tool acting for the person using it, it is ordinary software. Using it to bypass another company's protections, create fake accounts, or break a site's terms is not, and the tool being available doesn't change that.
The short version
If a verification puzzle keeps rejecting you, work the list: audio option, VPN off, allow scripts, update the browser, reload, and set up a passkey so you skip the step next time. If you run a site, the real fix is on your side — offer an alternative that doesn't depend on eyesight and a steady hand, and keep a route to a human. And if you build the accessibility or QA tooling that has to get a genuine user through that step, read CaptchaAI's documentation and try it against a page you control before you wire it into anything.
