Fake “I’m not a robot” check: the Windows+R scam explained

A website tells you to press the Windows key and R, then Ctrl+V and Enter? It’s a scam. Close the page. A real robot check never asks you to press keys, open Run, or paste anything.

The box looks like the familiar “I’m not a robot” check. The steps are the trick. They paste a hidden command that can install software to steal passwords, email logins, and bank details. You are safe if you stop before those keys.

Check a suspicious message I already did the steps

The one rule to remember

A real CAPTCHA asks you to tick a box, type letters, or pick pictures. It never asks you to press keys, open the Run box, or paste anything.

What the fake check looks like

These are examples written in the style the FTC and Microsoft describe. The real pages change the words. Do not follow them.

“Verification step: press Windows+R, press Ctrl+V, press Enter.”
“Security verification. To prove you are human, press the Windows key and R, then Ctrl+V, then Enter.”
“I’m not a robot. Open Terminal, paste, and press Return to finish the check.”

On a Windows computer, Windows+R opens the Run box. Ctrl+V pastes. Enter runs whatever was pasted. On a Mac, the page tells you to open Terminal and paste. Either way, close the page.

6 warning signs

It tells you to press the Windows key and R
On a Windows computer, those two keys open a small box called Run. The FTC says a real robot check does not ask you to run commands.
It tells you to press Ctrl+V, or to paste
Ctrl+V pastes whatever was copied. Microsoft says the fake page can copy a hidden command before you paste it.
It tells you to press Enter
Enter tells the computer to run what you just pasted. That is how the harmful software starts.
On a Mac, it says to open Terminal and paste
Terminal is a program that runs typed commands. Microsoft says a real CAPTCHA or verification step never needs a pasted command in Terminal.
A line of text appears that you did not copy
The website copied it for you. Microsoft has found that the pasted text is a command, sometimes dressed up to look like a verification code.
It skips the usual picture puzzle
A real check asks you to tick a box, type letters, or pick pictures, such as traffic lights. Keyboard steps are the warning.

What a real check asks you to do

Tick a box that says you are not a robot.
Type letters or numbers you can see.
Pick pictures, such as traffic lights, crosswalks, or fire hydrants.
Stay on the web page. A real check does not open another program.

What to do if you see it

Close the page. You can also close the whole browser.
Do not press the keys and do not paste.
Do not call any phone number on that page.
Tell someone you trust, such as a family member or a staff person at your senior center.

What to do if you already did it

Take a breath. These steps are the ones the FTC recommends if a fake check installed harmful software, plus a call to your bank because that software can steal banking logins. Do them in order. A trusted person can sit with you.

Disconnect from the internet. Unplug the network cable or turn off Wi-Fi. This stops the scammers from reaching your accounts.
Run a security scan. Use Windows Security, or the security program already on the computer, and let it finish. Keep that program up to date.
Change your passwords from a different device, such as your phone or another computer that did not do the steps. Start with email and your bank. Turn on two-factor authentication, which asks for a second code when you sign in.
Call your bank using the number on your card or statement. Tell them what happened and ask them to watch the account.
Get help from a trusted person. A family member, a friend, or senior center staff can read these steps with you. A repair shop you already know can scan the computer.
Report it at ReportFraud.ftc.gov. If you are 60 or older, the National Elder Fraud Hotline is 1-833-372-8311.

More help, including free hotlines and what to do if money moved, is in I got scammed. What do I do?

Free tools to practice and check

Scam Text and Email Checker: paste a message that tells you to press Windows+R and see the warning.
Link Checker: see the real website name behind a link.
Scam or Real? quiz: practice spotting scams, with a printable version for groups.
I got scammed. What do I do?: steps and free hotlines if you already followed the fake check.

Get one simple safety tip a day

Free, plain-language tips to avoid scams. Unsubscribe anytime.

Questions people ask

Is a robot check that says press Windows+R real?

No. The FTC says a real CAPTCHA gives you a picture or text task. A screen that says press Windows + R, then Ctrl + V, then Enter is a scam that can install harmful software.

What does a real "I’m not a robot" check ask me to do?

It asks you to tick a box, type the letters you see, or choose pictures such as traffic lights or fire hydrants. It stays in the web page. It does not ask you to press keys, open Run, or paste anything.

I only clicked the box. Did I install anything?

Clicking can copy a command without you noticing, but the software runs when you paste it and press Enter. Close the page and do not paste. If you want to be careful, run a security scan.

I pressed the keys and hit Enter. What now?

Disconnect from the internet, run a security scan, and change your passwords from a different phone or computer. Call your bank using the number on your card, and ask a trusted person to help. Our "I got scammed" guide has the full steps and free hotlines.

What if I have a Mac?

The same scam tells Mac users to open Terminal and paste. Do not paste. If you already did, disconnect from the internet, run a security scan, and change passwords from a different device. On some newer Macs, the computer may block the paste and show a warning. Stop there.

Could this be my bank, Microsoft, or the website I trust?

A real bank, Microsoft, or any trusted site checks that you are human inside the page. None of them ask you to open Run or Terminal to prove you are human. Close the page and go to the site yourself by typing the address.

Where do I report a fake robot check?

Report it to the FTC at ReportFraud.ftc.gov. If you are 60 or older, you can also call the National Elder Fraud Hotline at 1-833-372-8311. The steps are in our "I got scammed" guide.

Sources

Last updated: October 17, 2026. This guide is general information, not technical support or legal advice.