Fraud Defense (reCAPTCHA)

I'm seeing a specific Android device consistently receive floor scores from reCAPTCHA Enterprise, and I can't find any signal that explains why. Looking for anyone who has seen this pattern or knows what an assessment with score: 0 and no reason codes indicates for the mobile SDK.What I observe on one device (Pixel 9 Pro, Android 17, stock, bootloader locked, verified boot green)Android SDK com.google.android.recaptcha:recaptcha:18.9.2, app installed from Google Play. Every assessment comes back like this:tokenProperties: valid: true, action matches expectedAction, clientSignalsFailed: falseriskAnalysis: score: 0, reasons: [], extendedVerdictReasons: []- 12 attempts over two days: eleven scored 0.0, one scored 0.1. Never a reason code.- Persists across two networks (Wi-Fi and mobile data), across an app-process restart with a fresh client and fresh token, and across a device reboot.- The SDK reports no error — executeTask succeeds every time, so the app has nothing to react to.- In log

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).Impact:- Users cannot read the challenge buttons or error messages, effectively blocking them from completing verification on the affected flow (a public request form).- Root-cause evidence (deterministic 7-bit corruption)  We analyzed the corrupted strings. Each displayed character equals the original code point masked to its low 7 bits — i.e. displayed = String.fromCharCode(originalCodePoint & 0x7F). This is deterministic, not random.  - Taking the low 7 bits of each code point reproduces the corrupted string exactly.  - Characters whose result falls into a control code disappear or become line breaks (e.g. 認 U+8A8D → 0x0D, 再 U+518D → 0x0D, り U+308A →0x0A, み U+307F → DEL), which accounts for the stray line breaks inside the popup.  -

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

We are using Google reCAPTCHA v3 with Thai language (hl=th). The captcha challenge occasionally displays corrupted Thai characters in the instruction area and action button. The issue occurs inside the Google-hosted reCAPTCHA dialog while the rest of the application renders Thai text correctly.Observations:Application localization is functioning correctly. Issue is occurring only within the reCAPTCHA iframe. Multiple users have reported the issue. Browser refresh does not always resolve the problem. No recent changes were made to the application code or reCAPTCHA integration.Please investigate whether there is an issue with the Thai localization resources or rendering of reCAPTCHA. 

Have noticed this appearing in the document head when inspecting the page. Just wondering what this is and why it's been added. Does anyone know? Thanks

Hi Google Cloud Community,We recently enabled reCAPTCHA v3 as a fraud-prevention mechanism and monitored the risk scores for approximately two weeks to understand its assessment behavior.During the first two days, we did not consider the scores for evaluation, as we followed the recommendation in the documentation to allow sufficient time for the risk analysis/assessment to establish.For the following five days, the results were as expected:Fraudulent transactions: The reCAPTCHA score was consistently 0.4 or below. Genuine transactions: The score was consistently 0.5 or above. This separation between fraudulent and genuine transactions was useful for defining our fraud-detection threshold.However, after approximately five days, we started seeing inconsistent results. Our genuine transactions are now also receiving very low scores, sometimes as low as 0.0, even though these transactions are legitimate.This behavior is making it difficult for us to reliably distinguish between genuine an

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often starting our app at more or less the same time)Any idea why this is happening?  What I can do to improve this? ...

My phone always says contact your IT administrator or forbidden from accessing your Google takeout or using ADB it says only administrators are allowed access. I previously had access right after I downloaded the app and lost it. How the hell do I get rid of this deep administrator a hole thats in every facet of my phone and in the system. Maybe amongst tech I will get help. I have tried literally everywhere else. Thank you... 

Hello We are seeing unexpectedly low reCAPTCHA Enterprise scores for our iOS application starting around May 20, 2026.The tokens are valid, but many legitimate users are receiving low scores ( 0.1–0.2 >= ), affecting application flows.We don’t have active support plan, and there is no option to enable support plan for our project, can anyone point to right place for resolving this issueThank you.

Loading a page with recaptcha on Safari for iOS 16 and above, (es. user agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1) the request https://www.google.com/recaptcha/api2/pat returns 401 and recaptcha initialization fails.Additional details can be found in this Github issue https://github.com/google/recaptcha/issues/561 (49 upvotes), but I ask the participants to comment here too.

Hi Fraud Defense team, Starting 2026-07-17 (zero occurrences before that date), legitimate desktopChrome 150 users on our site began receiving very low reCAPTCHA Enterprisescores (0.1-0.3) with reason code UNEXPECTED_ENVIRONMENT on our sign-inaction, blocking them from logging in. Tokens are fully valid and the actionmatches the expected action -- only the risk score collapsed. Setup: web score-based site key (v3-style), server-side assessments via thereCAPTCHA Enterprise API. Users are mostly in Taiwan on residential ISPs. Evidence that this is browser-version-specific(rejected vs. allowed-with-low-score counts, same site key and threshold,last 2 days):- Chrome 150 desktop: 306 rejected / 22 allowed- Chrome 149 desktop: 2 rejected / 23 allowed- Edge (Chromium 150): 1 rejected / 4 allowed Daily rejected count for Chrome 150: 0 (before Jul 17) -> 98 (Jul 17) ->113 (Jul 18) -> 180 (Jul 19), still rising. Chrome 150 had already beenrolled out for about two weeks before Jul 17, so

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

Hi,I'm a developer who set up reCAPTCHA keys for a client's  300 websites, and I'm trying to fully remove myself as an owner. I've hit a dead end created by the migration and need your help.Here's what happened, in order:1. I first tried to transfer/manage ownership of the keys in the classic admin console (google.com/recaptcha/admin), but the owner controls were greyed out, with this message:"Use Cloud IAM policies to manage key owners. You can remove owners until only one remains here. For more information, see Access control with IAM (https://docs.cloud.google.com/recaptcha/docs/access-control)."2. Following that instruction, I migrated the keys to the client's Google Cloud project and used Cloud IAM to transfer ownership to the client, then removed my own IAM role from the project.3. But my Google account  is still listed as the sole legacy owner of these keys in the CLASSIC console (google.com/recaptcha/admin). Per that same message, the console only lets me "remove owners until o